fix:(feat): use random nonce for encryption key generation

[odaysec]

Use a non-hard-coded nonce seed when building the encryption key+nonce bundle. fix generate_encryption_key_nonce() (around lines 1096–1102), generate 4 random bytes using the same SystemRandom, convert them into a u32 (e.g., little-endian), and pass that value to get_encryption_key_with_nonce(...) instead of literal 1. This keeps the existing data format and flow unchanged (still u32 nonce + key bytes), avoids introducing new dependencies, and resolves the hard-coded cryptographic value. Also handle rand.fill(...) result for nonce bytes the same way existing code handles key generation (without changing function signatures/behavior).

• O'Reilly Using Salts, Nonces, and Initialization Vectors
• CWE-1204