fix(admin): support quota resets over plain HTTP

Generate canonical UUIDv4 redeem IDs with crypto.getRandomValues so reset
confirmation works on non-secure HTTP origins. Preserve the pending
operation ID when retrying uncertain consumption.

Validation: frontend lint/type checks/build, browser composable checks
with mocked APIs on HTTP/localhost/HTTPS, and 10 related backend tests
passed. No real reset credits were consumed.

Refs #62

Co-authored-by: Codex <noreply@openai.com>

frontend/src/views/accounts/composables/useAccountResetCredits.ts

@@ -147,7 +147,7 @@ export function useAccountResetCredits(options: {
         accountId,
         creditId: credit.id,
         credit,
-        redeemRequestId: globalThis.crypto.randomUUID(),
+        redeemRequestId: generateRedeemRequestId(),
         hasTransportFailure: false,
       }
     }
@@ -257,6 +257,15 @@ export function useAccountResetCredits(options: {
   }
 }
 
+function generateRedeemRequestId() {
+  // 普通 HTTP 管理端没有 randomUUID；getRandomValues 仍可生成密码学安全的 UUIDv4。
+  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16))
+  bytes[6] = (bytes[6] & 0x0F) | 0x40
+  bytes[8] = (bytes[8] & 0x3F) | 0x80
+  const hex = Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('')
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`
+}
+
 function isAmbiguousConsumeError(error: unknown) {
   if (!(error instanceof ApiError))
     return false