fix(fe): crypto.randomUUID not in non-secure contexts (LAN http) -> newId() fallback

The LAN dev URL (http://192.168.1.202) is not a secure context, so
crypto.randomUUID is undefined and adding a photo threw
'TypeError: crypto.randomUUID is not a function'. Add newId() (randomUUID
when available, else crypto.getRandomValues UUIDv4) and use it in draft()
and PhotoImport. Verified in Chromium.

frontend/src/capture/PhotoImport.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
   import { createEventDispatcher } from 'svelte';
   import type { Photo } from '../lib/types';
+  import { newId } from '../lib/types';
   import { keepForSheet } from '../mask/sheetKeep';
   import { decodeOrientedBitmap } from './decodeOrientedBitmap';
 
@@ -75,7 +76,7 @@
       if (!f.type.startsWith('image/')) { error = 'Only images'; return; }
       const url = URL.createObjectURL(f);
       previews.push({
-        id: crypto.randomUUID(),
+        id: newId(),
         seq: i,
         isCalibration: i === 0,
         url,