chore(types): enable warn_return_any and cast all no-any-return sites

Turn on mypy warn_return_any (pyproject) and resolve the 84 resulting
[no-any-return] errors across 43 files with typing.cast() at the return
sites — runtime no-ops that make the declared return type explicit where a
dependency (SQLAlchemy scalar/first/one, httpx .json(), subprocess, docker
SDK) hands back Any. No behavior change: no DTO/table field types altered, no
validation/coercion calls added, every cast reflects the true runtime type.

Locks in return-type strictness so the class of bug where a function silently
widens to Any can't regress. mypy decnet/ clean; adversarially verified
behavior-preserving (84 casts 1:1 with prior returns).

Bump tornado 6.5.5 -> 6.5.7 (CVE-2026-49854, transitive via snakeviz).

decnet/templates/pop3/server.py

@@ -205,7 +205,7 @@ def _seed_dict_to_rfc822(entry: dict) -> str | None:
     date = str(entry.get("date") or "")
     body = entry["body"]
     if "\r\n\r\n" in body or "\n\n" in body:
-        return body  # already a full RFC 822 message
+        return cast(str, body)  # already a full RFC 822 message
     return (
         f"Date: {date}\r\n"
         f"From: {from_name} <{from_addr}>\r\n"