docs(security): document localStorage privacy + note ID fallback (#8)

- README gains a "Datenschutz & Speicherung" section: local single-user tool,
  unencrypted localStorage, avoid shared devices, export JSON to back up.
- Comments the generateId Math.random fallback as a non-crypto last resort,
  acceptable for local employee ids.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

js/data.js

@@ -10,6 +10,8 @@ function generateId() {
     const h = [...b].map(x => x.toString(16).padStart(2, '0'));
     return `${h.slice(0,4).join('')}-${h.slice(4,6).join('')}-${h.slice(6,8).join('')}-${h.slice(8,10).join('')}-${h.slice(10,16).join('')}`;
   }
+  // Last-resort fallback for environments without Web Crypto. Not cryptographically
+  // strong, but adequate for local, non-security-sensitive employee ids.
   return Date.now().toString(36) + Math.random().toString(36).slice(2, 10);
 }