ci(sonar): leave the React root and the mascot videos out of the analysis

Every scan spent 300 of its 450-830 seconds in the JS security sensor's
React render simulation, which starts at client/src/main.tsx and ran into
its fixed time limit each time. main.tsx holds the stylesheets and the
mount call; what it renders is analysed through its own files. The .mp4
clips under client/src were read as text and only produced encoding
warnings.

sonar-project.properties

@@ -19,7 +19,9 @@ sonar.test.inclusions=\
    shared/src/**/*.spec.ts,\
    plugin-sdk/test/**/*.test.ts
 
-# Keep generated output and test files out of source analysis
+# Keep generated output, test files and media out of source analysis (the
+# mascot clips under client/src are video; read as text they only fill the
+# log with encoding warnings)
 sonar.exclusions=\
    **/node_modules/**,\
    **/dist/**,\
@@ -29,7 +31,16 @@ sonar.exclusions=\
    **/*.test.ts,\
    **/*.test.tsx,\
    **/*.spec.ts,\
-   **/*.d.ts
+   **/*.d.ts,\
+   **/*.mp4,\
+   client/src/main.tsx
+
+# client/src/main.tsx above is the React root (the stylesheets and the mount
+# call around <App/>). From it the JS security sensor simulates rendering
+# the whole app, and that simulation ran into its fixed 300 s limit on every
+# scan, which was most of the scan's time. The file holds no logic of its
+# own; everything it renders is analysed through its own files. The vitest
+# config leaves it out of coverage for the same reason.
 
 # Coverage — lcov paths relative to repo root, one per package
 # (each package's vitest config emits lcov to <pkg>/coverage/).