fix: make the app boot on an insecure origin, and re-aim the capture harness

Three things, all found by trying to re-shoot the product imagery and failing.

**`crypto.randomUUID` is secure-context only.** `main.ts` called it at module top
level for its three wire identities, so on any origin that is not HTTPS and not
`localhost` the call threw before the scene was built and the app stopped at
"Starting up" with one TypeError and no other symptom. Every way a developer
normally opens this app is a secure context — `vite dev` and `vite preview` serve
localhost, the deployed site is HTTPS — which is why this survived since 3326d2e.
It breaks the brand-capture harness, which serves `dist/` over
`http://tera.lumbridgecorp.com:5210` so the app can read its own hostname and
decide which door it is; it breaks the plain `http://` static host STATIC.md
explicitly invites; and it breaks opening the dev server by LAN IP to try it on a
phone. `src/ids.ts` prefers the platform's `randomUUID` and falls back to
`getRandomValues`, which carries no such restriction. The tests exercise the
fallback specifically, because the happy path was never the broken one.

**`waitForFunction` was ignoring its own timeout.** Playwright's signature is
`(pageFunction, arg, options)` and all four call sites in `shots.mjs` and
`films.mjs` passed `{ timeout: 180_000 }` second, binding it as the predicate's
argument. The wait silently used the 30 s default, which was invisible for as
long as the app booted inside thirty seconds and started failing the moment the
California board grew its relief — with "Timeout 30000ms exceeded" reported
against a line that plainly reads 180_000.

**The office shot list photographed a building that no longer exists.** The
`expect` guard caught it and refused to shoot, which is exactly what it is for:
chapter 0 is "Front Door" now, not "The Floor". But the captions were staler than
the labels — they described forty-eight metres by eighteen, thirty-six seats in
four benches and a fourteen-metre interstitial commons, and Lumbridge HQ is a
live/work studio now. Re-aimed at the buildings that exist: `office-floor` and
`office-desks` at the SF studio (the second specifically at the bench, because the
desk mic and the machine speaker are the new thing there), `office-commons` at the
LA courtyard, `office-hangar` still at Frontier Valley and now honest about being
in development. The four ids are deliberately unchanged: the manifest emits a
`ShotId` union that v4 imports, so renaming one fails v4's typecheck at push.

Also `#onboarding-host` joins the harness's clutter list. The first-run card is
correct behaviour for a real visitor and wrong in a product photograph, and it had
quietly placed itself in the middle of every frame — which is the general hazard
that list exists for, because a shot with a stray card still renders and still
looks deliberate.

`bay-relief`'s daylight frame moves from 07:40 to 09:10. At 07:40 the marine layer
buried the heightfield the shot exists to demonstrate; the version currently on the
site is almost entirely white. Its `note` moves with it, since the note names the
hour and a stale one describes light that is not in the picture.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/brand-assets/harness.mjs

@@ -178,12 +178,20 @@ export function clockShim(iso) {
  *   would be a picture of a permission nobody browsing the site actually has.
  * - `#rail` is the keyboard hint strip, which is advice for a person holding a
  *   keyboard, not information about the city.
+ * - `#onboarding-host` is the first-run card. It is *correct* — a real visitor
+ *   on a first visit does see it — but it is teaching the reader how to fly a
+ *   board they are looking at a photograph of, and it covers the bottom-left
+ *   quarter of the frame. It is also the newest thing here, which is the
+ *   general hazard this list exists for: every card added to the interface is
+ *   in the product imagery by default, and silently, because the shot still
+ *   renders and still looks deliberate. Anything mounted over the canvas that
+ *   is not the world or an instrument reading it belongs in this list.
  */
 export const FURNITURE = {
   /** Never wanted in a photograph: the boot curtain and the phone's panel scrim. */
-  transient: ["#boot", "#scrim"],
-  BARE: ["#panel", "#panel-toggle", "#corner", "#rail", "#source", "#tier"],
-  CLUTTER: ["#rail", "#tier", "#source", "#panel-toggle"],
+  transient: ["#boot", "#scrim", "#onboarding-host"],
+  BARE: ["#panel", "#panel-toggle", "#corner", "#rail", "#source", "#tier", "#onboarding-host"],
+  CLUTTER: ["#rail", "#tier", "#source", "#panel-toggle", "#onboarding-host"],
 };
 
 /** Hide selectors, and wait a beat for the layout to settle before shooting. */