FRE-4807: Remediate security review Medium findings

- Add SHA256 verification for k6 binary download (supply chain integrity)
- Remove literal 'test-token' fallback for API_TOKEN in CI workflow;
  add validation step that fails if LOAD_TEST_API_TOKEN secret is missing
- Replace 'test-token' fallback with empty string + warning in run-all.sh
- Replace 'test-token' fallback with empty string in all 4 service scripts

scripts/load-test/run-all.sh

@@ -16,7 +16,10 @@ mkdir -p "$REPORT_DIR"
 BASE_URL="${LOAD_TEST_BASE_URL:-http://localhost:3000}"
 TARGET_RPS="${TARGET_RPS:-500}"
 DURATION="${DURATION:-300s}"
-API_TOKEN="${API_TOKEN:-test-token}"
+API_TOKEN="${API_TOKEN:-}"
+if [[ -z "$API_TOKEN" ]]; then
+  echo "⚠️ API_TOKEN not set (load tests will run without auth)"
+fi
 
 echo "=== ShieldAI Combined Load Test ==="
 echo "Timestamp: $TIMESTAMP"