Draw random bytes for a signed-in SparkVault client

The draw the SparkVault console and mobile app take for their own working values (a stored key's id, a cache key, a pairing secret's server share). It answers an interactive SparkVault session only: an API key is refused, so an integration draws from POST /entropy/generate. It is never refused for a lapsed plan or an empty bandwidth pool and is not recorded as the account's usage; the API rate limit applies as to every request, and each signed-in person has an hourly budget of draws here.