Weak RNG (Math.random) for API keys, share tokens, generateId()

Severity: Medium · Where: api-keys.ts:17, sharing.ts:17, dynamodb.ts:265-269 API keys, share tokens, and generateId() use Math.random() instead of a CSPRNG. (Session/user/OAuth-state tokens correctly use crypto.randomUUID().) Impact: Combined with no rate limiting (#rate-limit), keys/tokens become enumerable/guessable. Fix: Switch to crypto.getRandomValues() / crypto.randomUUID().