fix(auth): make nonce randomness explicit

[sppidy]

Summary

• return internal-auth nonces directly from OsRng instead of a zero-initialized intermediate
• replace hard-coded nonce fixtures with real generated nonces
• add a freshness regression test

Closes the code patterns behind CodeQL alerts #1 through #5. The reported production path was already safe because OsRng.fill_bytes overwrote the complete buffer before signing; this change makes that guarantee explicit to the analyzer.

Validation

• cargo test -p shared internal_auth -- --nocapture (5 passed)
• cargo test -p server internal_auth -- --nocapture (3 passed)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.