chore(types): enable warn_return_any and cast all no-any-return sites

Turn on mypy warn_return_any (pyproject) and resolve the 84 resulting
[no-any-return] errors across 43 files with typing.cast() at the return
sites — runtime no-ops that make the declared return type explicit where a
dependency (SQLAlchemy scalar/first/one, httpx .json(), subprocess, docker
SDK) hands back Any. No behavior change: no DTO/table field types altered, no
validation/coercion calls added, every cast reflects the true runtime type.

Locks in return-type strictness so the class of bug where a function silently
widens to Any can't regress. mypy decnet/ clean; adversarially verified
behavior-preserving (84 casts 1:1 with prior returns).

Bump tornado 6.5.5 -> 6.5.7 (CVE-2026-49854, transitive via snakeviz).

decnet/swarm/updater_client.py

@@ -17,7 +17,7 @@ import asyncio
 import hashlib
 import socket
 import ssl
-from typing import Any, Optional
+from typing import Any, Optional, cast
 
 import httpx
 
@@ -159,12 +159,12 @@ class UpdaterClient:
     async def health(self) -> dict[str, Any]:
         r = await self._require().get("/health")
         r.raise_for_status()
-        return r.json()
+        return cast(dict[str, Any], r.json())
 
     async def releases(self) -> dict[str, Any]:
         r = await self._require().get("/releases")
         r.raise_for_status()
-        return r.json()
+        return cast(dict[str, Any], r.json())
 
     async def update(self, tarball: bytes, sha: str = "") -> httpx.Response:
         """POST /update. Returns the Response so the caller can distinguish