fix: return error from GenerateNATSToken instead of panicking

Same pattern as H-5 — crypto/rand failure caused a panic. Now returns
(string, error) so callers can handle it gracefully.

cmd/hive/cmd/admin.go

@@ -630,7 +630,11 @@ func runAdminInit(cmd *cobra.Command, args []string) {
 	certPath := admin.GenerateCertificatesIfNeeded(configDir, force, bindIP)
 
 	// Generate NATS token
-	natsToken := admin.GenerateNATSToken()
+	natsToken, err := admin.GenerateNATSToken()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error generating NATS token: %v\n", err)
+		os.Exit(1)
+	}
 	fmt.Println("\n🔒 Generated NATS authentication token")
 
 	if hiveRoot == "" {

hive/admin/admin.go

@@ -285,13 +285,13 @@ func DefaultAccountName() string {
 	return "hive"
 }
 
-// generateNATSToken generates a secure random token for NATS
-func GenerateNATSToken() string {
+// GenerateNATSToken generates a secure random token for NATS
+func GenerateNATSToken() (string, error) {
 	bytes := make([]byte, 32)
 	if _, err := rand.Read(bytes); err != nil {
-		panic(err)
+		return "", fmt.Errorf("crypto/rand failure: %w", err)
 	}
-	return "nats_" + base64.URLEncoding.EncodeToString(bytes)[:32]
+	return "nats_" + base64.URLEncoding.EncodeToString(bytes)[:32], nil
 }
 
 // GenerateCACert generates a Certificate Authority certificate and key

hive/admin/admin_test.go

@@ -65,7 +65,8 @@ func TestDefaultAccountID(t *testing.T) {
 }
 
 func TestGenerateNATSToken_Format(t *testing.T) {
-	token := GenerateNATSToken()
+	token, err := GenerateNATSToken()
+	assert.NoError(t, err)
 	assert.True(t, strings.HasPrefix(token, "nats_"))
 	assert.Len(t, token, 37) // 5 prefix + 32 random
 	// URL-safe base64: no '+' or '/'
@@ -74,7 +75,11 @@ func TestGenerateNATSToken_Format(t *testing.T) {
 }
 
 func TestGenerateNATSToken_Uniqueness(t *testing.T) {
-	assert.NotEqual(t, GenerateNATSToken(), GenerateNATSToken())
+	t1, err := GenerateNATSToken()
+	assert.NoError(t, err)
+	t2, err := GenerateNATSToken()
+	assert.NoError(t, err)
+	assert.NotEqual(t, t1, t2)
 }
 
 // --- Config file generation ---