fix: resolve all ruff and bandit lint/security issues

- Remove unused Optional import (F401) in telemetry.py
- Move imports above module-level code (E402) in web/db/models.py
- Default API/web hosts to 127.0.0.1 instead of 0.0.0.0 (B104)
- Add usedforsecurity=False to MD5 calls in JA3/HASSH fingerprinting (B324)
- Annotate intentional try/except/pass blocks with nosec (B110)
- Remove stale nosec comments that no longer suppress anything

decnet/collector/worker.py

@@ -215,7 +215,7 @@ def _reopen_if_needed(path: Path, fh: Optional[Any]) -> Any:
     if fh is not None:
         try:
             fh.close()
-        except Exception:
+        except Exception:  # nosec B110 — best-effort file handle cleanup
             pass
     path.parent.mkdir(parents=True, exist_ok=True)
     return open(path, "a", encoding="utf-8")
@@ -272,7 +272,7 @@ def _stream_container(container_id: str, log_path: Path, json_path: Path) -> Non
             if fh is not None:
                 try:
                     fh.close()
-                except Exception:
+                except Exception:  # nosec B110 — best-effort file handle cleanup
                     pass