fix: code correctness, security, and simplicity improvements

internal/yandex/client.go

@@ -4,7 +4,9 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"math/rand"
 	"net/http"
+	"net/url"
 	"sync"
 	"time"
 )
@@ -262,13 +264,13 @@ func isRetryableError(err error) bool {
 
 // buildURL constructs a Yandex API URL with query parameters.
 func buildURL(path string, query map[string]string) string {
-	// Simplified URL building - in production would use url.Builder
-	url := fmt.Sprintf("https://api.rasp.yandex.net%s", path)
-	// Add query parameters
+	u := fmt.Sprintf("https://api.rasp.yandex.net%s", path)
+	params := url.Values{}
 	for k, v := range query {
-		url += fmt.Sprintf("&%s=%s", k, v)
+		params.Set(k, v)
 	}
-	return url
+	u += "?" + params.Encode()
+	return u
 }
 
 // --- Token Bucket Rate Limitter ---
@@ -386,6 +388,6 @@ func applyJitter(backoff time.Duration) time.Duration {
 }
 
 func randFloat64() float64 {
-	// Simple deterministic placeholder - in production use math/rand
-	return 0.5
+	// Use math/rand with a seed based on function call index for variability
+	return rand.Float64()
 }