chore(types): enable warn_return_any and cast all no-any-return sites

Turn on mypy warn_return_any (pyproject) and resolve the 84 resulting
[no-any-return] errors across 43 files with typing.cast() at the return
sites — runtime no-ops that make the declared return type explicit where a
dependency (SQLAlchemy scalar/first/one, httpx .json(), subprocess, docker
SDK) hands back Any. No behavior change: no DTO/table field types altered, no
validation/coercion calls added, every cast reflects the true runtime type.

Locks in return-type strictness so the class of bug where a function silently
widens to Any can't regress. mypy decnet/ clean; adversarially verified
behavior-preserving (84 casts 1:1 with prior returns).

Bump tornado 6.5.5 -> 6.5.7 (CVE-2026-49854, transitive via snakeviz).

decnet/web/db/sqlmodel_repo/__init__.py

@@ -18,7 +18,7 @@ import os
 
 import orjson
 import uuid
-from typing import Any, Optional, List
+from typing import Any, Optional, List, cast
 
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncEngine, AsyncSession, async_sessionmaker
@@ -183,7 +183,7 @@ class SQLModelRepository(
             result = await session.execute(statement)
             state = result.scalar_one_or_none()
             if state:
-                return json.loads(state.value)
+                return cast(dict[str, Any], json.loads(state.value))
             return None
 
     async def set_state(self, key: str, value: Any) -> None:  # noqa: ANN401