Addresses CodeQL alert #35 (js/insecure-randomness). Not actually exploitable here (it only picks which eligible host a database lands on, not a secret), but the fix is free and matches the crypto-secure generator already used for passwords in this same file.