[grade=A] DC-085: Replace Math.random() with crypto for security-sensitive IDs

- port-lock-manager.js: lockId uses crypto.randomBytes(8) instead of Math.random()
- openclaw.js: generateToken() uses crypto.randomBytes(24).toString('base64url') — 192 bits entropy
- Sampling uses (health-checker 5%, resource-monitor 10%) intentionally left as Math.random

Codex grade: A (21,294 tokens). All 1539 tests pass.

dashcaddy-api/src/managers/port-lock-manager.js

@@ -6,6 +6,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const lockfile = require('proper-lockfile');
 const platformPaths = require('../../platform-paths');
 const { log } = require('../utils/logging');
@@ -58,7 +59,7 @@ class PortLockManager {
       throw new Error('Ports must be a non-empty array');
     }
 
-    const lockId = `lock-${Date.now()}-${Math.random().toString(36).substring(7)}`;
+    const lockId = `lock-${Date.now()}-${crypto.randomBytes(8).toString('hex')}`;
     const sortedPorts = [...new Set(ports)].sort((a, b) => parseInt(a) - parseInt(b));
     const acquiredLocks = [];
     const releaseFunctions = [];