Phase 4 randomizer is client-side; reuses /api/movies and the direct Supabase browser client. No new routes added.
