fix(security): strengthen referral-code generation (currently 8-char UUID prefix, enumerable)

[cypriannwokolo2-creator]

Summary

incentives/service.go:549-552 derives the referral code from the first 8 chars of the user UUID - a ~32-bit, predictable/enumerable space enabling code enumeration/claim abuse.

Acceptance Criteria

• Generate high-entropy codes (cryptographically random, collision-safe)
• Enforce uniqueness with retry
• Tests for entropy + collision handling

Complexity

Medium-High.

[Peolite1]

@Peolite1 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I would love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Peolite1 to this issue.

[cypriannwokolo2-creator]

Already fixed: referral codes use crypto/rand with 10 random bytes (80 bits entropy), 20 hex chars. Collision-safe with retry logic.