Security: Replace Math.random() with crypto.randomUUID() for all ID generation

[anchapin]

Description

Multiple security PRs (#826, #822) identified predictable ID generation using Math.random():

Vulnerability

• Type: CWE-190 - Integer Overflow or Wraparound
• Severity: MEDIUM
• Impact: Predictable identifiers could lead to session correlation, collisions, or DOM predictability

Current Anti-Pattern

const id = Math.random().toString(36).substr(2, 9);

Proposed Solution

Use cryptographically secure crypto.randomUUID():

const id = crypto.randomUUID();

Components to Fix

• BatchConversionManager (session IDs)
• MermaidDiagram (component IDs)
• NotificationSystem (notification IDs)
• ErrorBoundary (error IDs)
• Toast system (toast IDs)
• analytics.ts service

Acceptance Criteria

• All ID generation uses crypto.randomUUID()
• Fallback for browsers without crypto API
• Unit tests verify UUID format
• No collisions in generated IDs
• All security lints pass

[traycerai]

Warning

Insufficient credits. Please purchase more credits or upgrade your plan to continue using Traycer.