Add Certificates page and Traefik API frontend client

backend/internal/auth/session.go

@@ -41,11 +41,26 @@ func GenerateCSRFToken() (string, error) {
 }
 
 func generateRandomString(length int) (string, error) {
-	bytes := make([]byte, length)
-	if _, err := rand.Read(bytes); err != nil {
+	// Generate enough random bytes to produce `length` base64url chars without truncation loss.
+	// RawURLEncoding without padding: 3 bytes -> 4 chars. So ceil(length*3/4) bytes needed.
+	n := (length*3 + 3) / 4
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
 		return "", err
 	}
-	return base64.URLEncoding.EncodeToString(bytes)[:length], nil
+	s := base64.RawURLEncoding.EncodeToString(b)
+	if len(s) > length {
+		s = s[:length]
+	}
+	// In the unlikely case s is shorter (rounding), pad by generating more - but n calculation guarantees >= length
+	if len(s) < length {
+		extra := make([]byte, length-len(s))
+		if _, err := rand.Read(extra); err != nil {
+			return "", err
+		}
+		s += base64.RawURLEncoding.EncodeToString(extra)[:length-len(s)]
+	}
+	return s, nil
 }
 
 type SessionData struct {