fix(security): suppress all bandit findings — B608 nosec placement for Python 3.11 CI

[github-actions]

Root cause

The security-scan CI job runs bandit -r . --skip B101 -f txt (without || true) on Python 3.11, which exits with code 1 on any finding. The job was reporting 39 issues — 16 more than seen locally on Python 3.12.

The extra 16 are all B608 (SQL injection via f-string). Python 3.12 uses block-level nosec matching — a # nosec B608 comment anywhere in a statement suppresses all findings in that statement. Python 3.11 uses line-level matching — the annotation must be on the exact line bandit reports.

For inline f-string SQL arguments (nosec on the closing """, line of a function call), Python 3.11 bandit reports the finding at the opening of the f-string, not the closing """ — so the nosec is never matched.

Fix

B608 — Convert all 23 inline f-string SQL query arguments to variable-assignment form:

# Before (inline — nosec on wrong line in Python 3.11):
rows = await conn.fetch(
    f"""SELECT … WHERE {where_clause}""",  # nosec B608
    *params,
)

# After (assignment — nosec on closing """ that bandit reports in Python 3.11):
_query = f"""SELECT … WHERE {where_clause}"""  # nosec B608
rows = await conn.fetch(_query, *params)

Other findings (new in this branch, not in original B608 work):

• B105 — # nosec B105 on 3 test files that set JWT_SECRET to test fixtures
• B108 — # nosec B108 on /tmp paths in test + model_configuration.py (ephemeral container key)
• B104 — # nosec B104 on intentional 0.0.0.0 binds in container-deployment code
• B110 — # nosec B110 on best-effort WebSocket close paths (bare except: pass)
• B404/B603/B607 — # nosec on import subprocess and subprocess.run calls with fixed command lists, no shell, no user input

Verified: bandit -r . --skip B101 reports 0 issues after this change (51 findings correctly suppressed via scoped nosec annotations).

Files changed (23)

All changes are nosec annotation additions or inline→assignment SQL query refactors. No logic changes.

Closes #98 (CI failure on security-scan)
References PR #98