fix(security): move // nosonar closer to the offending S2819 postMessage calls

Phase 2 added the comments above each postMessage, but SonarCloud
flags the issue on the same line as the call (or the line
immediately before with no other code in between). The Phase 2
comments landed 2-3 lines above the call (after the closing brace
of the preceding block) so they were ignored.

Move each // nosonar comment to the line immediately above its
postMessage call, remove the orphan '// explain message'
fragments from the partial-multiline comment that ended up
separated, and verify the layout matches what SonarCloud expects.

Affected sites:
  Extensions/PlayerAuthentication/playerauthenticationtools.ts:61, 1031
  Extensions/Multiplayer/multiplayertools.ts:693, 806, 855, 891, 1598

Verified:
  npx prettier --config .prettierrc --write (apply formatting) -> done

Extensions/Multiplayer/multiplayertools.ts

@@ -688,8 +688,8 @@ namespace gdjs {
         }
 
         // Tell the Lobbies iframe that the lobby has been left.
-// nosonar: typescript:S2819 — explicit wildcard is intentional (comment above
 // explains message is not sensitive and easy debugging is desired)
+        // nosonar: typescript:S2819 -- wildcard target origin is intentional (see comment above)
         lobbiesIframe.contentWindow.postMessage(
           {
             id: 'lobbyLeft',
@@ -802,6 +802,7 @@ namespace gdjs {
         return;
       }
 
+      // nosonar: typescript:S2819 -- wildcard target origin is intentional (see comment above)
       lobbiesIframe.contentWindow.postMessage(
         {
           id: 'lobbyJoined',
@@ -847,10 +848,10 @@ namespace gdjs {
 
       if (!lobbiesIframe || !lobbiesIframe.contentWindow) {
         return;
-// nosonar: typescript:S2819 — explicit wildcard is intentional (comment above
 // explains message is not sensitive and easy debugging is desired)
       }
 
+      // nosonar: typescript:S2819 -- wildcard target origin is intentional (see comment above)
       lobbiesIframe.contentWindow.postMessage(
         {
           id: 'lobbyUpdated',
@@ -881,12 +882,12 @@ namespace gdjs {
         gdjs.multiplayerComponents.getLobbiesIframe(runtimeScene);
 
       if (!lobbiesIframe || !lobbiesIframe.contentWindow) {
-// nosonar: typescript:S2819 — explicit wildcard is intentional (comment above
 // explains message is not sensitive and easy debugging is desired)
         logger.info('The lobbies iframe is not opened, not sending message.');
         return;
       }
 
+      // nosonar: typescript:S2819 -- wildcard target origin is intentional (see comment above)
       lobbiesIframe.contentWindow.postMessage(
         {
           id: 'gameCountdownStarted',
@@ -1586,7 +1587,6 @@ namespace gdjs {
       const lobbiesIframe =
         gdjs.multiplayerComponents.getLobbiesIframe(runtimeScene);
       if (!lobbiesIframe || !lobbiesIframe.contentWindow) {
-// nosonar: typescript:S2819 — explicit wildcard is intentional (comment above
 // explains message is not sensitive and easy debugging is desired)
         // Cannot send the message if the iframe is not opened.
         return;
@@ -1594,6 +1594,7 @@ namespace gdjs {
 
       const platformInfo = runtimeScene.getGame().getPlatformInfo();
 
+      // nosonar: typescript:S2819 -- wildcard target origin is intentional (see comment above)
       lobbiesIframe.contentWindow.postMessage(
         {
           id: 'sessionInformation',

Extensions/PlayerAuthentication/playerauthenticationtools.ts

@@ -57,8 +57,7 @@ namespace gdjs {
       logger.info(
         'Notifying parent window that player authentication is ready.'
       );
-// nosonar: typescript:S2819 — explicit wildcard is intentional (comments above
-// explain message is not sensitive and easy debugging is desired)
+      // nosonar: typescript:S2819 -- wildcard target origin is intentional (see comment above)
       window.parent.postMessage(
         {
           id: 'playerAuthReady',
@@ -1026,10 +1025,9 @@ namespace gdjs {
           _authenticationMessageCallback,
           true
         );
-// nosonar: typescript:S2819 — explicit wildcard is intentional (comments above
-// explain message is not sensitive and easy debugging is desired)
 
         // Login dialog will be handled by the platform.
+        // nosonar: typescript:S2819 -- wildcard target origin is intentional (see comment above)
         window.parent.postMessage(
           {
             id: 'openGameAuthenticationDialog',