fix(auth): remove device code random bias

[kilo-code-bot]

Summary

• Replaces modulo-based device authorization code character selection with crypto.randomInt() so each allowed character is selected without modulo bias.
• Preserves the existing unambiguous character set and XXXX-XXXX code format while resolving CodeQL alert 233.

Verification

N/A - backend-only random code generation change; no manual browser flow exercised.

Visual Changes

N/A

Reviewer Notes

• CodeQL alert: https://github.com/Kilo-Org/cloud/security/code-scanning/233
• Focused Jest verification was attempted with pnpm --filter web test -- src/lib/device-auth/device-auth.test.ts -t generateDeviceCode --runInBand, but this container triggered dependency bootstrap/prepare and the prepare build was killed with exit 137. docker is also unavailable here, so the test DB status check could not run.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The change correctly eliminates modulo bias in device code generation by replacing randomBytes + % with crypto.randomInt(), which provides a uniform distribution with no regressions.

Files Reviewed (1 file)

• apps/web/src/lib/device-auth/device-auth.ts

---

Notes:

• randomInt(chars.length) correctly returns a value in [0, chars.length) using a cryptographically secure source — correct API usage.
• chars has 32 characters (a power of 2), so the old modulo bias was actually zero in practice, but the new approach is still cleaner and aligns with the CodeQL alert intent.
• No memory leaks, no security regressions, no behavioral changes to the XXXX-XXXX format or the unambiguous character set.

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 334,883 tokens}

_{Review guidance: REVIEW.md from base branch main}