Package verified Dune checkpoints for TrueNAS and HTTPS proxying

Serve built Workers directly through pinned Miniflare with persistent D1-compatible storage and startup migrations. Build and verify Docker images in CI; publish main checkpoints to GHCR for manual TrueNAS updates on port 33046. Preserve explicit public-origin checks and LAN-compatible cryptographic operation IDs.

Validation: 5,153 offline tests, typecheck, lint and build; 49 HTTP integration cases; HTTPS-origin create/join/chat/seat protection, foreign-origin rejection, exact saved-seat restart and browser asset serving. Independent persistence/proxy review completed. Clean Docker CI and actual NAS installation follow this source checkpoint.

lib/seat-handover.ts

@@ -1,3 +1,4 @@
+import { randomId } from './random-id';
 import type { GameView } from '../game/engine';
 
 export const HANDOVER_CLAIM_STORAGE_KEY = 'dune.pending-seat-handover.v1';
@@ -98,7 +99,7 @@ export function createHandoverKit(
       version: 1,
       roomCode,
       playerId,
-      offerId: crypto.randomUUID(),
+      offerId: randomId(),
       handoverSecret: secret(),
     }),
   );
@@ -111,7 +112,7 @@ export function createHandoverClaim(kit: SeatHandoverKit): SavedHandoverClaim {
       playerId: kit.playerId,
       offerId: kit.offerId,
       handoverSecret: kit.handoverSecret,
-      operationId: crypto.randomUUID(),
+      operationId: randomId(),
       newSessionToken: secret(),
     }),
   });