fix: guard crypto.randomUUID for insecure origins (toast store, message-id, contact uid)

[texchi2]

Fixes #887 (calendar Save reports failure while the event is created; duplicates on retry) and the same-class silent compose-Send failure.

Root cause

crypto.randomUUID is [SecureContext]-gated — on a plain-http LAN origin (a common self-hosted pilot deployment) it is undefined, and three call sites called it unguarded:

• stores/toast-store.ts addToast() — every toast.success/toast.error threw TypeError: crypto.randomUUID is not a function. In handleSaveEvent the success toast runs before the dialog-close, so a successful CalendarEvent/set was followed by a throw; the catch's toast.error threw again uncaught; the dialog stayed open reporting failure while the server had the event, and user retries created duplicates.
• lib/jmap/client.ts generateMessageId() — compose Send failed silently after the draft save, before EmailSubmission was ever issued (drafts piled up).
• lib/jmap/client.ts createContact uid fallback — contact creation without a uid crashed pre-request.

Fix

All three now use the guarded generateUUID() already in lib/utils.ts (typeof-check, falling back to a v4 UUID built from crypto.getRandomValues, which insecure contexts do provide).

Verification

Headless-Chromium reproduction on an insecure origin (isSecureContext === false), logged into a real JMAP server (Stalwart 0.16):

• Pre-fix: one Save click → uncaught TypeError at Object.addToast (via toast.error), dialog stays open, server has exactly 1 new event.
• Post-fix: same click → dialog closes, "Event created" toast renders, no page errors, server has exactly 1 new event.
• Compose Send on-device (iPhone/iPad PWA over LAN http): confirmed sending after the generateMessageId guard.

Not touched, flagged for a follow-up: unguarded crypto.subtle.digest in lib/oauth/pkce.ts and lib/plugin-sandbox/bundle-integrity.ts (same class, separate feature paths), and navigator.clipboard absence on insecure origins in the copy-link paths (try/caught; degrades gracefully once toasts work).

🤖 Generated with Claude Code

https://claude.ai/code/session_01MtFkcUA8VM2XAKZKzptpqy