chore(types): enable warn_return_any and cast all no-any-return sites

Turn on mypy warn_return_any (pyproject) and resolve the 84 resulting
[no-any-return] errors across 43 files with typing.cast() at the return
sites — runtime no-ops that make the declared return type explicit where a
dependency (SQLAlchemy scalar/first/one, httpx .json(), subprocess, docker
SDK) hands back Any. No behavior change: no DTO/table field types altered, no
validation/coercion calls added, every cast reflects the true runtime type.

Locks in return-type strictness so the class of bug where a function silently
widens to Any can't regress. mypy decnet/ clean; adversarially verified
behavior-preserving (84 casts 1:1 with prior returns).

Bump tornado 6.5.5 -> 6.5.7 (CVE-2026-49854, transitive via snakeviz).

decnet/web/db/sqlmodel_repo/identities.py

@@ -9,7 +9,7 @@ the reads.
 from __future__ import annotations
 
 from datetime import datetime, timezone
-from typing import Any, Optional
+from typing import Any, Optional, cast
 
 from sqlalchemy import desc, func, select, update
 from sqlmodel import col
@@ -42,10 +42,10 @@ class IdentitiesMixin(_MixinBase):
                 if identity is None:
                     return None
                 if identity.merged_into_uuid is None:
-                    return identity.model_dump(mode="json")
+                    return cast(dict[str, Any], identity.model_dump(mode="json"))
                 current_uuid = identity.merged_into_uuid
             # Hit the hop cap — surface what we have rather than recurse.
-            return identity.model_dump(mode="json")
+            return cast(dict[str, Any], identity.model_dump(mode="json"))
 
     async def list_identities(
         self, limit: int = 50, offset: int = 0,