fix: replace Math.random with CSPRNG

[hiddeco]

CASA-46 requires all random value generation to use cryptographically secure PRNGs. This migrates every call site in both backend and frontend.

Backend: random.uniform, random.randint, and random.choices are replaced with secrets.randbelow throughout OAuth retry jitter, email scheduling, and web-fetcher backoff. Readable ID generation is extracted into core/readable_id.py using secrets.choice (rejection-sampled, zero bias), deduplicating logic from collection.py and connection.py.

Frontend: inline Math.random ID generators are consolidated into lib/readable-id.ts using crypto.getRandomValues(new Uint32Array(...)). Uint32Array is used instead of Uint8Array to avoid modulo bias (256 % 36 = 4 biased values). FilterBuilderModal switches to crypto.randomUUID for React keys. The unused Input import in CreateCollectionView is removed.

[cubic-dev-ai]

No issues found across 12 files

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="frontend/eslint.config.js">

<violation number="1" location="frontend/eslint.config.js:31">
P1: Custom agent: **Check for Cursor Rules Drift**

Cursor rules drift: a new frontend security convention (forbid `Math.random`, require Web Crypto RNG) was added in ESLint but not reflected in the relevant Cursor frontend rule (`.cursor/rules/frontend-rules.mdc`). Update that rule so Cursor-generated code follows the same CSPRNG requirement.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".cursor/rules/frontend-rules.mdc">

<violation number="1" location=".cursor/rules/frontend-rules.mdc:345">
P1: Custom agent: **Check for Cursor Rules Drift**

Update the backend Cursor rule too. This PR introduces a repo-wide randomness convention, but the added rule only covers frontend APIs; `.cursor/rules/backend-rules.mdc` still lacks guidance to use Python `secrets.*` instead of `random.*`, so Cursor remains out of sync for backend changes.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}