fix: resolve all ruff and bandit lint/security issues

- Remove unused Optional import (F401) in telemetry.py
- Move imports above module-level code (E402) in web/db/models.py
- Default API/web hosts to 127.0.0.1 instead of 0.0.0.0 (B104)
- Add usedforsecurity=False to MD5 calls in JA3/HASSH fingerprinting (B324)
- Annotate intentional try/except/pass blocks with nosec (B110)
- Remove stale nosec comments that no longer suppress anything

decnet/web/router/auth/api_login.py

@@ -42,6 +42,6 @@ async def login(request: LoginRequest) -> dict[str, Any]:
     )
     return {
         "access_token": _access_token,
-        "token_type": "bearer",  # nosec B105
+        "token_type": "bearer",  # nosec B105 — OAuth2 token type, not a password
         "must_change_password": bool(_user.get("must_change_password", False))
     }