fix(ui): work over plain http, and catch render crashes at the boundaries - #2865

`crypto.randomUUID` is only defined in a secure context, so every page that
minted an id with it threw when the app was served over plain http from
anything but localhost — the new-schedule page did it at mount, which blanked
the page. One `randomId()` helper now serves every call site; it returns a v4
UUID because some of these ids are validated as UUIDs server-side.

Signed-off-by: Nicholas Bucher <[email protected]>

Nothing has rendered when the stylesheet, branding or mock-backend step throws,
so the boundary above cannot see it and the user gets the blank page this
branch exists to remove. The fallback moves out of the boundary so both can
render it, and the route boundary gains the test for its own claim: a page that
throws is replaced, the shell around it is not.

Signed-off-by: Nicholas Bucher <[email protected]>

…tform

`getRandomValues` carries no secure-context condition — only `randomUUID` and
`subtle` do — so the ids are properly random for the same line count.

The copy fallback now answers the document's own `copy` event rather than
selecting a borrowed textarea, which is what antd does and what removes the
need to know where the focus trap is. Success is the event having fired, not
what `execCommand` returns, since it returns true for copying nothing.

Also: a rejected copy reports failure rather than leaving the button silent, a
missing root element no longer throws inside the handler that renders the
failure, and the retry button's comment says what it does.

Signed-off-by: Nicholas Bucher <[email protected]>

…IdNoCrypto

Signed-off-by: Nicholas Bucher <[email protected]>

# Conflicts:
#	ui/src/mocks/transport.ts

The page boundary showed one line and dropped the rest, so a crash mid-session
told the reader less than the console did. It now carries the same disclosure
the root fallback has, in theme tokens, with the formatter shared between them.

`storedMode` moves to its own module so reading the theme costs no import of
the provider the root fallback renders above.

Signed-off-by: Nicholas Bucher <[email protected]>

`crypto.randomUUID` was fixed once in #1868 and came back when the interface was
rewritten and the file holding the helper went with it. A note in a file is lost
the same way twice, so the rule states it where a rewrite cannot drop it, and
names the helper to use instead. `navigator.clipboard` is listed for the same
reason: bare, it fails silently rather than loudly.

Signed-off-by: Nicholas Bucher <[email protected]>