Entropy audit: RNG integration review and open hardening items

Audits every security-sensitive random value in packages/ against a
Coldcard-class checklist: where each bit of unpredictability originates,
whether that source is present in the production build, and what happens
when it fails.

No predictable-fallback defect. crypto/random.ts is the single chokepoint
for every secret this codebase mints and it throws rather than degrading;
randomUniformInt rejection-samples, so wordlist and charset selection carry
no modulo bias; generatePrivateKey rejection-samples valid scalars. Crypto
deps are exact-pinned and CI already emits an SBOM.

Three hardening items recorded, in the order they should be done:

- M2: nothing tests that the RNG fails closed. Additive, cannot touch the
  derivation chain, and it is what protects M1's fix from regressing later.
- M1: nonceOverride/ivOverride are reachable from the public
  @bitlogin/core/crypto surface. No production caller passes them, but
  nonce reuse in NIP-44/NIP-04 is immediate plaintext recovery, so the
  parameter should not be one autocomplete away from application code.
- L1: Math.random in the backup-quiz word picker. Not a secret, but it
  forces a standing exception in any Math.random ban rule.

Docs only; no source or behaviour change.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01HtNMsKzzFTPURemX7tT19u

docs/TODO.md

@@ -2,6 +2,21 @@
 
 Updated: 2026-07-31
 
+## Entropy audit (2026-07-31)
+
+[`entropy-audit-2026-07-31.md`](./entropy-audit-2026-07-31.md) — RNG and
+randomness-integration audit. **No predictable-fallback defect:** `random.ts`
+is the single chokepoint, throws rather than degrading, and rejection-samples to
+avoid modulo bias. Three hardening items, in order:
+
+- **M2** — nothing tests that the RNG fails closed. Do this first; it is
+  additive, cannot touch the derivation chain, and it is what stops M1's fix
+  from regressing later.
+- **M1** — `nonceOverride` / `ivOverride` are reachable from the public
+  `@bitlogin/core/crypto` surface. Move behind a non-exported test module.
+- **L1** — `Math.random` in the backup-quiz word picker (`element.ts:1471`).
+  Not a secret, but it forces a standing exception in any `Math.random` ban rule.
+
 ## Owner action items
 
 1. **Close the Dependabot PR on