fix: insecure randomness

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

src/lib/generateUserId.ts

@@ -1,5 +1,8 @@
+import { randomBytes } from 'crypto';
+
 export const generateUserId = () => {
-	const userId = 'user_' + Date.now() + '_' + Math.random().toString(36).substr(2, 9);
+	const secureRandomString = randomBytes(8).toString('base36').substr(0, 9);
+	const userId = 'user_' + Date.now() + '_' + secureRandomString;
 
 	return userId;
 };