fix(m3): uuid secure-context fallback + middle-tier SKU business rules

- frontend: uuid() helper (crypto.randomUUID -> getRandomValues) for plain-HTTP LAN UAT
- slabs.py: empty SKU at create -> NULL (no-SKU-yet is transient, filled in Review)
- review.py: ready-gate enforces REVIEW-45 (SKU 3-24 alnum+hyphen) in the middle tier
- DB CHECK stays as backstop only (referential/structural), per layering principle

frontend/src/App.svelte

@@ -1,6 +1,6 @@
 <script lang="ts">
   import { onMount, onDestroy } from 'svelte';
-  import { supported } from './browser';
+  import { supported, uuid } from './browser';
   import { createCaptureSession, type CaptureSession } from './capture/session';
   import type { Capture, Measures } from './capture/capture.types';
   import { eighthsToIn } from './capture/capture.types';
@@ -89,7 +89,7 @@
     saveError = '';
     startSaving();
     try {
-      const id = crypto.randomUUID();
+      const id = uuid();
       await createSlab({
         id,
         sku: '',
@@ -111,7 +111,7 @@
       for (let i = 0; i < pngItems.length; i++) {
         const it = pngItems[i];
         await uploadPhoto(id, {
-          photoId: crypto.randomUUID(),
+          photoId: uuid(),
           seq: i + 1,
           isCalibration: it.role === 'calibration',
           original: it.blob,