chore(types): enable warn_return_any and cast all no-any-return sites

Turn on mypy warn_return_any (pyproject) and resolve the 84 resulting
[no-any-return] errors across 43 files with typing.cast() at the return
sites — runtime no-ops that make the declared return type explicit where a
dependency (SQLAlchemy scalar/first/one, httpx .json(), subprocess, docker
SDK) hands back Any. No behavior change: no DTO/table field types altered, no
validation/coercion calls added, every cast reflects the true runtime type.

Locks in return-type strictness so the class of bug where a function silently
widens to Any can't regress. mypy decnet/ clean; adversarially verified
behavior-preserving (84 casts 1:1 with prior returns).

Bump tornado 6.5.5 -> 6.5.7 (CVE-2026-49854, transitive via snakeviz).

decnet/engine/services_live.py

@@ -24,7 +24,7 @@ from __future__ import annotations
 
 import subprocess  # nosec B404
 from pathlib import Path
-from typing import Any, Literal, Optional
+from typing import Any, Literal, Optional, cast
 
 import anyio
 
@@ -217,7 +217,7 @@ async def _topology_decky(
         cfg = d.get("decky_config") or {}
         name = cfg.get("name") or d.get("name")
         if name == decky_name:
-            return d
+            return cast(dict[str, Any], d)
     raise ServiceNotFoundError(
         f"decky {decky_name!r} is not in topology {topology_id!r}"
     )
@@ -343,7 +343,7 @@ def _fleet_state_or_raise() -> tuple[Any, Path]:
         raise ServiceMutationError(
             "no fleet state on disk — run `decnet up` first"
         )
-    return state
+    return cast(tuple[Any, Path], state)
 
 
 def _fleet_find_decky(config: Any, decky_name: str) -> Any: