security(server): use SysRng directly for bootstrap token generation

Replace make_rng()/StdRng with UnwrapErr(SysRng) to eliminate the PRNG
intermediate layer and make OS entropy derivation explicit and unambiguous.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/Cargo.lock

@@ -771,6 +771,7 @@ dependencies = [
  "proptest",
  "prost-types",
  "rand 0.10.1",
+ "rand_core 0.10.1",
  "rcgen",
  "restructed",
  "rstest",

server/Cargo.toml

@@ -21,6 +21,7 @@ mutants = "0.0.4"
 prost = "0.14.3"
 prost-types = { version = "0.14.3", features = ["chrono"] }
 rand = "0.10.1"
+rand_core = "0.10.1"
 rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
 rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }

server/crates/arbiter-server/Cargo.toml

@@ -31,6 +31,7 @@ diesel_migrations = { version = "2.3.2", features = ["sqlite"] }
 async-trait.workspace = true
 tokio-stream.workspace = true
 rand.workspace = true
+rand_core.workspace = true
 rcgen.workspace = true
 chrono.workspace = true
 kameo.workspace = true

server/crates/arbiter-server/src/actors/bootstrap.rs

@@ -4,7 +4,8 @@ use arbiter_proto::{BOOTSTRAP_PATH, home_path};
 use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, messages};
-use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
+use rand::{RngExt, distr::Alphanumeric, rngs::SysRng};
+use rand_core::UnwrapErr;
 use subtle::ConstantTimeEq as _;
 use thiserror::Error;
 use zeroize::Zeroizing;
@@ -12,9 +13,7 @@ use zeroize::Zeroizing;
 const TOKEN_LENGTH: usize = 64;
 
 pub async fn generate_token() -> Result<String, std::io::Error> {
-    let rng: StdRng = make_rng();
+    let token = UnwrapErr(SysRng).sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
-
-    let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
         String::default(),
         |mut accum, char| {
             accum += char.to_string().as_str();