feat(id): defaultNewID via crypto/rand, injectable

id.go

@@ -0,0 +1,14 @@
+package main
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+)
+
+// NewID — production ID generator. 8 bytes crypto/rand -> 16 hex chars.
+// Cheap and unique enough. In tests, replace via StoreOptions.NewID for determinism.
+func NewID() string {
+	b := make([]byte, 8)
+	_, _ = rand.Read(b)
+	return hex.EncodeToString(b)
+}