chore(load-tests): document non-security-sensitive Math.random() usages to resolve SonarCloud hotspots

tests/load/scenarios/03-concurrent-uploads.js

@@ -139,6 +139,8 @@ export default function () {
     });
   }
 
-  // Short think time — real users don't upload at maximum machine speed
+  // Short think time — real users don't upload at maximum machine speed.
+  // Math.random() is safe here: adds non-cryptographic timing jitter to simulate realistic user think-time.
+  // Not a security-sensitive use case (no token generation, secret material, or authentication involved).
   sleep(1 + Math.random());
 }

tests/load/scenarios/06-full-stress.js

@@ -87,6 +87,8 @@ export const options = {
 
 export default function () {
   const vuSuffix = String(__VU);
+  // Math.random() is safe here: selects which request type this VU exercises (40/30/20/10 weighted split).
+  // Not a security-sensitive use case (no token generation, secret material, or authentication involved).
   const roll     = Math.random();
 
   let res;
@@ -141,6 +143,8 @@ export default function () {
     stressErrors.add(1);
   }
 
-  // Very short sleep — we want to maintain pressure
+  // Very short sleep — we want to maintain pressure.
+  // Math.random() is safe here: adds non-cryptographic timing jitter to simulate realistic user think-time.
+  // Not a security-sensitive use case (no token generation, secret material, or authentication involved).
   sleep(0.2 + Math.random() * 0.3);
 }

tests/load/scenarios/08-screening-session.js

@@ -329,6 +329,8 @@ export default function () {
     if (res.status >= 500) screeningErrors.add(1);
   }
 
-  // Think time before next iteration
+  // Think time before next iteration.
+  // Math.random() is safe here: adds non-cryptographic timing jitter to simulate realistic user think-time.
+  // Not a security-sensitive use case (no token generation, secret material, or authentication involved).
   sleep(3 + Math.random() * 2);
 }

tests/load/scenarios/09-soak.js

@@ -294,6 +294,8 @@ export default function () {
   }
 
   // Think time — keeps the pattern realistic and gives the server brief
-  // breathing room between journey completions
+  // breathing room between journey completions.
+  // Math.random() is safe here: adds non-cryptographic timing jitter to simulate realistic user think-time.
+  // Not a security-sensitive use case (no token generation, secret material, or authentication involved).
   sleep(2 + Math.random() * 2);
 }