Return error from tokenManager.Generate instead of panicking

A crypto/rand.Read failure is a process-level emergency, but the previous
implementation aborted the entire server. Propagate the error through
the TokenManager interface so callers (CreateAPIToken) can surface it
via the normal HTTP 500 path instead of crashing.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2 files changed, 8 insertions, 3 deletions

diff --git a/player-server/internal/service/auth.go b/player-server/internal/service/auth.go
index 6bd2055..1fe468b 100644
--- a/player-server/internal/service/auth.go
+++ b/player-server/internal/service/auth.go
@@ -92,8 +92,13 @@ func (s *authService) Login(ctx context.Context, username, password string) (*Au
 }
 
 // CreateAPIToken creates a hashed API token and returns the one-time plaintext value.
+// A token generation failure (e.g. crypto/rand.Read returning an error) is
+// surfaced to the caller; the HTTP layer translates it into a 500 response.
 func (s *authService) CreateAPIToken(ctx context.Context, userID int64, name string, expiresAt *time.Time) (*CreateAPITokenResult, error) {
-	plaintext, hash := s.tm.Generate()
+	plaintext, hash, err := s.tm.Generate()
+	if err != nil {
+		return nil, fmt.Errorf("generate api token: %w", err)
+	}
 	now := s.clock.Now()
 	token := &model.APIToken{
 		UserID:    userID,
diff --git a/player-server/internal/service/auth_test.go b/player-server/internal/service/auth_test.go
index 213f6e5..b01a2b3 100644
--- a/player-server/internal/service/auth_test.go
+++ b/player-server/internal/service/auth_test.go
@@ -16,8 +16,8 @@ type fixedTokenManager struct {
 	hash      string
 }
 
-func (m fixedTokenManager) Generate() (string, string) {
-	return m.plaintext, m.hash
+func (m fixedTokenManager) Generate() (string, string, error) {
+	return m.plaintext, m.hash, nil
 }
 
 func (m fixedTokenManager) Hash(plaintext string) string {