fix: resolve all ruff and bandit lint/security issues

- Remove unused Optional import (F401) in telemetry.py
- Move imports above module-level code (E402) in web/db/models.py
- Default API/web hosts to 127.0.0.1 instead of 0.0.0.0 (B104)
- Add usedforsecurity=False to MD5 calls in JA3/HASSH fingerprinting (B324)
- Annotate intentional try/except/pass blocks with nosec (B110)
- Remove stale nosec comments that no longer suppress anything

decnet/prober/tcpfp.py

@@ -53,7 +53,7 @@ def _send_syn(
     # Suppress scapy's noisy output
     conf.verb = 0
 
-    src_port = random.randint(49152, 65535)
+    src_port = random.randint(49152, 65535)  # nosec B311 — ephemeral port, not crypto
 
     pkt = (
         IP(dst=host)
@@ -114,8 +114,8 @@ def _send_rst(
             )
         )
         send(rst, verbose=0)
-    except Exception:
-        pass  # Best-effort cleanup
+    except Exception:  # nosec B110 — best-effort RST cleanup
+        pass
 
 
 # ─── Response parsing ───────────────────────────────────────────────────────