feat(cli): add scalable voting load tests with k6 and Chromium

[edulix]

Voting load tests now have one public interface: step-cli load init, check, prepare, run, report, and image. A documented YAML workload selects k6 or Chromium, finite voter ownership, concurrency, executor, timeouts, resources and p50/p99/throughput goals. The installed CLI bundles its internal runtime and fixture; operators do not need a checkout or a Chromium recording for k6.

• Native preparation streams fresh encrypted ballots and patterned census CSVs with one shared password hash. Workers authenticate unique voters through Keycloak, read GetVoterStatus, download S3 publications, and cast through the normal API. Chromium exercises the complete portal and browser encryption.
• Local processes, Docker containers and indexed Kubernetes pods share the same immutable shard/attempt contract. Docker networking and bind mounts support devcontainer coordinators. Failures retain evidence and produce failing reports.
• Consolidate adapters under packages/voting-load, remove duplicate online runners, and move native encryption into step-cli. Add Rustdoc, configuration validation, generated command/reference documentation, and focused unit tests.
• Replace the report with a self-contained dashboard showing outcomes, throughput, latency distributions and goals. Request inventories stay in private JSON. Documentation includes a captured real report, executable setup/deployment commands and cleanup instructions.

Validation through the public CLI on this machine:

Workload	Result
k6, 4 local workers	120/120 accepted votes; 51.84 casts/s; cast p50/p99 27/57.8 ms; status p50/p99 29/69.2 ms
Chromium, 3 local workers	6/6 full portal journeys and accepted votes
k6 status-only, 3 workers	12/12 journeys, zero casts
Docker k6, 3 containers	12/12 accepted votes
Docker Chromium, 2 containers	2/2 full portal journeys and accepted votes
Fresh election from the trimmed fixture	Automatic setup, ceremony, S3 publication, native encryption and 6/6 accepted votes

Read-only PostgreSQL audits matched accepted receipts for the voting runs. Report screenshot capture, 29 Python tests, 10 Rust tests, Rustdoc, scoped TypeScript/ESLint/Prettier, REUSE and the Docusaurus build pass. One pre-existing Rust integration test remains ignored; live CLI workloads above provide the environment validation. Docusaurus retains unrelated existing link warnings.

Kubernetes orchestration and failure-time collection have unit coverage, but no live cluster run was performed. One million backend casts have not been tested; the finite range and single-hash preparation paths have unit coverage. These local smoke measurements are not deployment-capacity claims.

Application S3/status path: #3149. Parent issue: https://github.com/sequentech/meta/issues/12767. This PR remains stacked on the E2E release base.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[edulix]

The complete voting flow, CLI, load tests and documentation are included in #3152 (release/10.0). The corresponding main PR is #3149. Review and validation are tracked in https://github.com/sequentech/meta/issues/12767.