feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

internal/webapp/auth_sessionid.go

@@ -0,0 +1,33 @@
+package webapp
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+)
+
+// GenerateFirstRunPassword returns a fresh random password suitable
+// for the worker's first-run webapp credential. The output is 24
+// bytes of crypto/rand encoded as URL-safe base64 (no padding), which
+// is roughly 32 characters long and safe to print once into the
+// worker log.
+//
+// Phase 1 (MVP) only: a stronger entropy scheme can replace this in
+// later phases if needed.
+func GenerateFirstRunPassword() (string, error) {
+	buf := make([]byte, 24)
+	if _, err := rand.Read(buf); err != nil {
+		return "", fmt.Errorf("webapp: read random bytes: %w", err)
+	}
+	return base64.RawURLEncoding.EncodeToString(buf), nil
+}
+
+// newSessionID is the underlying primitive for both session cookies
+// and CSRF tokens: 32 bytes from crypto/rand, URL-safe base64.
+func newSessionID() (string, error) {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return "", fmt.Errorf("webapp: read random bytes: %w", err)
+	}
+	return base64.RawURLEncoding.EncodeToString(buf), nil
+}