chore(types): enable warn_return_any and cast all no-any-return sites

Turn on mypy warn_return_any (pyproject) and resolve the 84 resulting
[no-any-return] errors across 43 files with typing.cast() at the return
sites — runtime no-ops that make the declared return type explicit where a
dependency (SQLAlchemy scalar/first/one, httpx .json(), subprocess, docker
SDK) hands back Any. No behavior change: no DTO/table field types altered, no
validation/coercion calls added, every cast reflects the true runtime type.

Locks in return-type strictness so the class of bug where a function silently
widens to Any can't regress. mypy decnet/ clean; adversarially verified
behavior-preserving (84 casts 1:1 with prior returns).

Bump tornado 6.5.5 -> 6.5.7 (CVE-2026-49854, transitive via snakeviz).

decnet/cli/topology.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import asyncio
-from typing import Optional
+from typing import Any, Optional, cast
 
 import typer
 from rich.console import Console
@@ -96,9 +96,9 @@ def _list() -> None:
     """List all topologies."""
     _require_master_mode("topology list")
 
-    async def _go() -> list[dict]:
+    async def _go() -> list[dict[Any, Any]]:
         repo = await _repo()
-        return await repo.list_topologies()
+        return cast(list[dict[Any, Any]], await repo.list_topologies())
 
     rows = asyncio.run(_go())
     if not rows:
@@ -140,7 +140,7 @@ def _show(topology_id: str = typer.Argument(..., help="Topology id")) -> None:
 
     def _decky_name(d: dict) -> str:
         cfg = d.get("decky_config") or {}
-        return cfg.get("name") or d.get("name") or d["uuid"]
+        return cast(str, cfg.get("name") or d.get("name") or d["uuid"])
 
     deckies_by_name = {_decky_name(d): d for d in hydrated["deckies"]}
     edges_by_lan: dict[str, list[dict]] = {}
@@ -296,9 +296,9 @@ def _mutate(
 
     async def _go() -> str:
         repo = await _repo()
-        return await repo.enqueue_topology_mutation(
+        return cast(str, await repo.enqueue_topology_mutation(
             topology_id, op, payload, expected_version=expected_version,
-        )
+        ))
 
     mid = asyncio.run(_go())
     _console.print(
@@ -319,9 +319,9 @@ def _mutations(
     """List queued/applied mutations for a topology."""
     _require_master_mode("topology mutations")
 
-    async def _go() -> list[dict]:
+    async def _go() -> list[dict[Any, Any]]:
         repo = await _repo()
-        return await repo.list_topology_mutations(topology_id, state=state)
+        return cast(list[dict[Any, Any]], await repo.list_topology_mutations(topology_id, state=state))
 
     rows = asyncio.run(_go())
     if not rows:

decnet/cli/utils.py

@@ -12,7 +12,7 @@ import signal
 import subprocess  # nosec B404
 import sys
 from pathlib import Path
-from typing import Any, Callable, Optional
+from typing import Any, Callable, Optional, cast
 
 import typer
 from rich.console import Console
@@ -91,7 +91,7 @@ def _is_running(match_fn) -> int | None:
         try:
             cmd = proc.info["cmdline"]
             if cmd and match_fn(cmd):
-                return proc.info["pid"]
+                return cast(int, proc.info["pid"])
         except (psutil.NoSuchProcess, psutil.AccessDenied):
             continue
     return None