chore(types): enable warn_return_any and cast all no-any-return sites

Turn on mypy warn_return_any (pyproject) and resolve the 84 resulting
[no-any-return] errors across 43 files with typing.cast() at the return
sites — runtime no-ops that make the declared return type explicit where a
dependency (SQLAlchemy scalar/first/one, httpx .json(), subprocess, docker
SDK) hands back Any. No behavior change: no DTO/table field types altered, no
validation/coercion calls added, every cast reflects the true runtime type.

Locks in return-type strictness so the class of bug where a function silently
widens to Any can't regress. mypy decnet/ clean; adversarially verified
behavior-preserving (84 casts 1:1 with prior returns).

Bump tornado 6.5.5 -> 6.5.7 (CVE-2026-49854, transitive via snakeviz).

decnet/prober/tlscert.py

@@ -18,7 +18,7 @@ from __future__ import annotations
 import hashlib
 import socket
 import ssl
-from typing import Any
+from typing import Any, cast
 
 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
@@ -42,7 +42,7 @@ def _iso_utc(dt: Any) -> str:
     and ``not_valid_before_utc`` (timezone-aware) — prefer the latter
     when available so we always emit explicit-Z ISO strings.
     """
-    return dt.strftime("%Y-%m-%dT%H:%M:%SZ")
+    return cast(str, dt.strftime("%Y-%m-%dT%H:%M:%SZ"))
 
 
 def _extract_sans(cert: x509.Certificate) -> list[str]: