fix(16.2): IN-04 make upload ids without crypto.randomUUID

crypto.randomUUID exists only in a secure context, so an admin served
over plain HTTP from a LAN host threw on every editor upload while the
status line still said uploading. uploadRequestId falls back to a v4
UUID from crypto.getRandomValues, or a time and counter id when no
crypto object exists.

assets/src/blogeditor/element.ts

@@ -548,7 +548,7 @@ export class BlogEditorElement extends HTMLElement {
   }
 
   #upload(file: File): void {
-    const id = crypto.randomUUID()
+    const id = uploadRequestId()
     const name = file.name
     const timer = setTimeout(() => {
       if (!this.#pending.delete(id)) return
@@ -640,3 +640,26 @@ export class BlogEditorElement extends HTMLElement {
 function isImage(file: File): boolean {
   return IMAGE_TYPES.includes(file.type)
 }
+
+let uploadCounter = 0
+
+/**
+ * uploadRequestId returns a new id for a summer-upload request. It is
+ * crypto.randomUUID where the admin runs in a secure context. Over plain
+ * HTTP from a host other than localhost randomUUID does not exist, so it is
+ * a version 4 UUID built from crypto.getRandomValues (available in every
+ * context), or a time and counter id when no crypto object exists at all.
+ */
+export function uploadRequestId(): string {
+  const c: Partial<Crypto> | undefined = globalThis.crypto
+  if (c && typeof c.randomUUID === 'function') return c.randomUUID()
+  if (c && typeof c.getRandomValues === 'function') {
+    const bytes = c.getRandomValues(new Uint8Array(16))
+    bytes[6] = (bytes[6]! & 0x0f) | 0x40
+    bytes[8] = (bytes[8]! & 0x3f) | 0x80
+    const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`
+  }
+  uploadCounter += 1
+  return `upload-${Date.now().toString(36)}-${uploadCounter}`
+}