fix(lint): drop ruff errors from 1470 to 0 across app/ and tests/

- Exclude generated SDK (sdks/python) and operational scripts from ruff lint
- Add targeted per-file ignores for ASYNC*, S310, S603, S607, S108, S314,
  S102, PIE810, SIM102 in scripts/
- Auto-fix safe categories (I001, F401, W292, F841, PIE790, RUF100, etc.)
- Bulk-fix S110 (try-except-pass), S112 (try-except-continue), S311 (random),
  S324 (md5/sha1), S301 (pickle) and similar lint categories
- Rename N806 non-lowercase locals, including ML X/y variables preserved
  with noqa for scikit-learn conventions
- Replace urllib.request calls with httpx.AsyncClient / httpx.Client (S310)
- Wrap blocking os.path/os calls in asyncio.get_running_loop().run_in_executor
- Replace subprocess.run with asyncio.create_subprocess_exec in async contexts
- Store asyncio.create_task return values in _background_tasks set (RUF006)
- Convert hardcoded subprocess binary names to absolute paths (S607) where
  appropriate; add noqa where path is config-driven (CAST_PATH, etc.)
- Parameterize SQL queries with placeholders and add noqa for sanitized inputs
- Fix all mechanical categories: SIM102, PIE810, TC001/2/3, S108, S314, S107,
  S306, S301, N802/N815/N817, S104, S605, S501, RUF022, UP031
- Add missing 'import asyncio' where referenced but not imported (F821)
- Fix E402 module-import-not-at-top by adding '# noqa: E402' for circular-import
  safe cases and code-defined imports
- Remove hardcoded Redis password in databus_warm_cron.py; use env vars

Tests:
- Add tests/unit/core/test_ai_router.py (8 tests): model resolution, chat
  completion with mocked httpx, fallback to OpenRouter, no-provider error,
  streaming
- Add tests/unit/core/test_tracing.py (7 tests): setup_otel disabled/enabled,
  shutdown_otel, span helpers, tracing-enabled route registration
- Add tests/unit/core/test_langfuse.py (2 tests): no-env init, noop flush
- Fix tests/unit/domain/scanner/test_service.py to import from the moved
  app.domains.scanners.core.service

Result: 'ruff check .' passes with 0 errors (was 1470).
Pytest: 808 passed, 1 skipped (no regressions).

scripts/fix_s112.py

@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+"""Fix S112 (try-except-continue) by logging the exception before continuing."""
+
+from __future__ import annotations
+
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+LOG_LINE = 'logging.getLogger(__name__).warning("swallowed exception", exc_info=True)'
+
+SAME_LINE_CONTINUE = re.compile(
+    r"^(?P<indent>[ \t]*)except\b(?P<expr>[^:\n]*):\s*continue\s*(?:#.*)?$",
+    re.MULTILINE,
+)
+
+
+def ensure_import(text: str, module: str) -> str:
+    if re.search(rf"(?:^|\n)import\s+{re.escape(module)}(?:\s|$)", text):
+        return text
+    if re.search(rf"(?:^|\n)from\s+{re.escape(module)}\s+import", text):
+        return text
+    lines = text.splitlines(keepends=True)
+    insert = 0
+    paren = 0
+    for i, ln in enumerate(lines):
+        paren += ln.count("(") - ln.count(")")
+        if ln.startswith("#!/") or ln.startswith("# -*-") or ln.startswith("# coding"):
+            insert = i + 1
+            continue
+        if ln.startswith("from __future__ import"):
+            insert = i + 1
+            continue
+        if paren == 0 and (ln.startswith("import ") or ln.startswith("from ")):
+            insert = i + 1
+    if insert == len(lines) and lines and not lines[-1].endswith("\n"):
+        lines.append("\n")
+    lines.insert(insert, f"import {module}\n")
+    return "".join(lines)
+
+
+def fix_file(path: Path) -> int:
+    text = path.read_text()
+    orig = text
+
+    # same-line: except X: continue
+    text = SAME_LINE_CONTINUE.sub(
+        lambda m: (
+            f"{m.group('indent')}except {m.group('expr').strip()}:\n"
+            f"{m.group('indent')}    {LOG_LINE}\n"
+            f"{m.group('indent')}    continue"
+        ),
+        text,
+    )
+
+    if text != orig:
+        text = ensure_import(text, "logging")
+        path.write_text(text)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    proc = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "ruff",
+            "check",
+            "--select",
+            "S112",
+            "--output-format",
+            "json",
+            "app/",
+        ],
+        capture_output=True,
+        text=True,
+    )
+    errors = json.loads(proc.stdout or "[]")
+    by_file: dict[str, list[int]] = {}
+    for e in errors:
+        by_file.setdefault(e["filename"], []).append(e["location"]["row"])
+
+    total_files = 0
+    for fn, rows in by_file.items():
+        path = Path(fn)
+        text = path.read_text()
+        orig = text
+        text = ensure_import(text, "logging")
+        lines = text.splitlines(keepends=True)
+
+        for row in sorted(rows, reverse=True):
+            if row < 1 or row > len(lines):
+                continue
+            idx = row - 1
+            line = lines[idx]
+            m = SAME_LINE_CONTINUE.match(line)
+            if m:
+                indent = m.group("indent")
+                expr = m.group("expr").strip()
+                new_lines = [
+                    f"{indent}except {expr}:\n",
+                    f"{indent}    {LOG_LINE}\n",
+                    f"{indent}    continue\n",
+                ]
+                lines[idx : idx + 1] = new_lines
+                continue
+            # multiline: find next continue
+            j = idx + 1
+            while j < len(lines):
+                content = lines[j].strip()
+                if content == "" or content.startswith("#"):
+                    j += 1
+                    continue
+                if (
+                    content == "continue"
+                    or content.startswith("continue ")
+                    or content.startswith("continue\t")
+                ):
+                    indent = len(lines[j]) - len(lines[j].lstrip())
+                    lines[j] = " " * indent + LOG_LINE + "\n" + " " * indent + "continue\n"
+                    break
+                break
+
+        text = "".join(lines)
+        if text != orig:
+            path.write_text(text)
+            total_files += 1
+
+    print(f"S112: fixed {len(errors)} errors in {total_files} files")