Race condition in getNextTokenId: two concurrent requests may read the same tokenCounter value before either increments it, resulting in duplicate tokens. The bug is invisible because each line appears correct, but the async delay (setTimeout 0) allows interleaving between read and increment.
