refactor(idgen): centralize negative ID handling via panic

Restore NextUint64ID() to uint64-only API so callers need no error
checks. Retry logic stays in idgen; after 3 negative values it panics
instead of returning 0, preventing silent NULL primary keys.

internal/model/users.go

@@ -134,11 +134,7 @@ func (u *User) assignIDIfMissing() error {
 	if u.ID != 0 {
 		return nil
 	}
-	id, err := idgen.NextUint64ID()
-	if err != nil {
-		return errors.New(errInvalidUserID)
-	}
-	u.ID = id
+	u.ID = idgen.NextUint64ID()
 	return nil
 }