Fix the web client crashing on the TV's plain-HTTP origin

[zorenkonte]

Summary

The client served by the TV at http://TV_IP:8090/ went blank after the first send and needed a reload. Browsers only expose crypto.randomUUID and navigator.clipboard on secure origins (HTTPS or localhost); the TV-served page is plain HTTP, so recording the send into history threw TypeError: crypto.randomUUID is not a function and React unmounted the page. The GitHub Pages copy is HTTPS, which is why it never showed there.

Changes

• Generate ids without a secure context: newId() uses crypto.randomUUID when available and otherwise builds a v4-shaped id from crypto.getRandomValues, with a Math.random fallback. Used for history entries, presets and devices.
• Copy to the clipboard on plain HTTP pages: copyText() falls back to a hidden textarea and execCommand('copy'), so "Copy as curl" and "Copy JSON" work on the TV-served copy.
• Show a crash screen instead of a blank page: an error boundary around the app renders the error and a Reload button if anything else ever throws.
• Note insecure-context shims in the client README.

Testing

• Reproduced first: built dist served on a fake http://192.168.1.50:8090 origin in headless Chromium, one send, page error crypto.randomUUID is not a function, body empty.
• After the fix on the same origin: no page errors, the per-device outcome row appears, History shows the entry with Re-send, "Copy as curl" shows the copied toast, and a second device can be added.
• npm run build && npm run lint clean; ./gradlew assembleDebug bundles the fixed client into the APK.

Checklist

• cd tv && ./gradlew testDebugUnitTest assembleDebug passes (bundling verified; no Kotlin change)
• cd client && npm run lint && npm run build passes
• No comments added to source files
• README updated when behavior, the API or setup changed
• Each commit is one logical change and builds on its own