fix: resolve all ruff and bandit lint/security issues

- Remove unused Optional import (F401) in telemetry.py
- Move imports above module-level code (E402) in web/db/models.py
- Default API/web hosts to 127.0.0.1 instead of 0.0.0.0 (B104)
- Add usedforsecurity=False to MD5 calls in JA3/HASSH fingerprinting (B324)
- Annotate intentional try/except/pass blocks with nosec (B110)
- Remove stale nosec comments that no longer suppress anything

decnet/web/db/models.py

@@ -3,14 +3,14 @@ from typing import Literal, Optional, Any, List, Annotated
 from sqlalchemy import Column, Text
 from sqlalchemy.dialects.mysql import MEDIUMTEXT
 from sqlmodel import SQLModel, Field
+from pydantic import BaseModel, ConfigDict, Field as PydanticField, BeforeValidator
+from decnet.models import IniContent
 
 # Use on columns that accumulate over an attacker's lifetime (commands,
 # fingerprints, state blobs).  TEXT on MySQL caps at 64 KiB; MEDIUMTEXT
 # stretches to 16 MiB.  SQLite has no fixed-width text types so Text()
 # stays unchanged there.
 _BIG_TEXT = Text().with_variant(MEDIUMTEXT(), "mysql")
-from pydantic import BaseModel, ConfigDict, Field as PydanticField, BeforeValidator
-from decnet.models import IniContent
 
 def _normalize_null(v: Any) -> Any:
     if isinstance(v, str) and v.lower() in ("null", "undefined", ""):