web: file attachments silently dropped on HTTP remote host — crypto.subtle undefined

Description

Version: 1.18.27
UI: web (opencode web --hostname 0.0.0.0 --port 8091), opened as http://linux:8091 (remote hostname, plain HTTP)

Steps:

1. Open web UI via remote http hostname (not localhost, no HTTPS)
2. Attach any image (button, drag-drop, paste — all same)
3. No thumbnail, no toast, no error in UI
4. Send — message arrives text-only

Expected: attachment sent as file part.
Actual: silently dropped.

Console:
Uncaught (in promise) TypeError: Cannot read properties of undefined (reading 'digest')
putBlob → addAttachments

Network: POST /session/{id}/prompt_async parts = [{type:text}] only.
DB: zero file parts in session.

Root cause: packages/app/src/utils/draft-store.ts blobID() uses crypto.subtle.digest.
crypto.subtle exists only in secure contexts. Remote http hostname = insecure → subtle undefined → putBlob throws → addAttachments rejects unhandled.

Same class as #11452 (randomUUID), different call site. Needs non-subtle fallback hash (or catch + random id).

Workaround: use http://localhost:8091 (secure context) or HTTPS.

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response