chore(types): enable warn_return_any and cast all no-any-return sites

Turn on mypy warn_return_any (pyproject) and resolve the 84 resulting
[no-any-return] errors across 43 files with typing.cast() at the return
sites — runtime no-ops that make the declared return type explicit where a
dependency (SQLAlchemy scalar/first/one, httpx .json(), subprocess, docker
SDK) hands back Any. No behavior change: no DTO/table field types altered, no
validation/coercion calls added, every cast reflects the true runtime type.

Locks in return-type strictness so the class of bug where a function silently
widens to Any can't regress. mypy decnet/ clean; adversarially verified
behavior-preserving (84 casts 1:1 with prior returns).

Bump tornado 6.5.5 -> 6.5.7 (CVE-2026-49854, transitive via snakeviz).

decnet/web/db/sqlmodel_repo/attackers/_core.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 
 import json
 import uuid as _uuid
-from typing import Any, List, Optional
+from typing import Any, List, Optional, cast
 
 from sqlalchemy import desc, func, outerjoin, select
 from sqlmodel import col
@@ -47,7 +47,7 @@ class AttackersCoreMixin(_MixinBase):
                 data = {**data, "uuid": row_uuid}
                 session.add(Attacker(**data))
             await session.commit()
-            return row_uuid
+            return cast(str, row_uuid)
 
     async def get_attacker_uuid_by_ip(self, ip: str) -> Optional[str]:
         """Return the :class:`Attacker` UUID for *ip*, or ``None``.
@@ -61,7 +61,7 @@ class AttackersCoreMixin(_MixinBase):
             result = await session.execute(
                 select(col(Attacker.uuid)).where(Attacker.ip == ip)
             )
-            return result.scalar_one_or_none()
+            return cast(Optional[str], result.scalar_one_or_none())
 
     async def get_attacker_by_uuid(self, uuid: str) -> Optional[dict[str, Any]]:
         async with self._session() as session: