fix(http): mint the fresh request id through randomId

The proxy no longer calls crypto.randomUUID itself, so it leaves the
client-random-id exemption list; the request-id helper uses the shared
randomId, which also works without a secure context.

src/__tests__/client-random-id-guard.test.ts

@@ -47,8 +47,6 @@ const SKIP_DIRS = new Set([
  * runs on the server where the property always exists.
  */
 const SERVER_SIDE_EXEMPT = new Set([
-  // Next middleware — runs on the edge runtime, never in the page.
-  "src/proxy.ts",
   // The one module allowed to reach for the platform call.
   "src/lib/random-id.ts",
 ]);

src/lib/http/request-id.ts

@@ -10,6 +10,8 @@
  *
  * Edge-safe: no Node imports, because `src/proxy.ts` reads it too.
  */
+import { randomId } from "@/lib/random-id";
+
 export const REQUEST_ID_PATTERN = /^[A-Za-z0-9-]{8,64}$/;
 
 /** The incoming id when it is well-formed, else `null`. */
@@ -22,5 +24,5 @@ export function acceptIncomingRequestId(
 
 /** The incoming id when it is well-formed, else a fresh UUID. */
 export function resolveRequestId(value: string | null | undefined): string {
-  return acceptIncomingRequestId(value) ?? crypto.randomUUID();
+  return acceptIncomingRequestId(value) ?? randomId();
 }