Web: image attachments fail on insecure origins; no client-side optimization

Summary

Attaching an image in the web app is unreliable, especially over remote/slow or insecure connections:

• Large photos upload as full-size payloads, and HEIC/HEIF are not accepted by the picker or readable by the vision model.
• On an insecure (http) origin, crypto.subtle is undefined, so blob ID generation throws and the attachment silently never gets added to the prompt.

Expected

Attach a JPG/PNG/HEIC and have it appear in the prompt reliably, with a reasonably-sized payload.

Actual

• Blob reference creation fails on insecure origins (TypeError: ... digest).
• Large images are sent un-optimized; HEIC/HEIF are unsupported.

Suggested fix

• Downscale/re-encode images client-side (HEIC/WebP/JPEG → JPEG, PNG kept, capped at 1920px / quality 0.82) with a short timeout fallback to the original.
• Fall back to crypto.getRandomValues when crypto.subtle is unavailable.

Related (not duplicates)

• #46168 (crypto.randomUUID in insecure context) - same root cause class (crypto unavailable on insecure origins), but affects other call sites (session delete, drag-drop). The uuid() helper already has a random fallback; the direct crypto.randomUUID() calls are separate. My change targets crypto.subtle in draft-store.ts specifically, which is still unfixed on dev.
• #45986 (images persisted but stripped from model request on v2 beta) - different layer (server-side stripMedia / message-v2 path), not the client attachment failure.