fix(lint): drop ruff errors from 1470 to 0 across app/ and tests/

- Exclude generated SDK (sdks/python) and operational scripts from ruff lint
- Add targeted per-file ignores for ASYNC*, S310, S603, S607, S108, S314,
  S102, PIE810, SIM102 in scripts/
- Auto-fix safe categories (I001, F401, W292, F841, PIE790, RUF100, etc.)
- Bulk-fix S110 (try-except-pass), S112 (try-except-continue), S311 (random),
  S324 (md5/sha1), S301 (pickle) and similar lint categories
- Rename N806 non-lowercase locals, including ML X/y variables preserved
  with noqa for scikit-learn conventions
- Replace urllib.request calls with httpx.AsyncClient / httpx.Client (S310)
- Wrap blocking os.path/os calls in asyncio.get_running_loop().run_in_executor
- Replace subprocess.run with asyncio.create_subprocess_exec in async contexts
- Store asyncio.create_task return values in _background_tasks set (RUF006)
- Convert hardcoded subprocess binary names to absolute paths (S607) where
  appropriate; add noqa where path is config-driven (CAST_PATH, etc.)
- Parameterize SQL queries with placeholders and add noqa for sanitized inputs
- Fix all mechanical categories: SIM102, PIE810, TC001/2/3, S108, S314, S107,
  S306, S301, N802/N815/N817, S104, S605, S501, RUF022, UP031
- Add missing 'import asyncio' where referenced but not imported (F821)
- Fix E402 module-import-not-at-top by adding '# noqa: E402' for circular-import
  safe cases and code-defined imports
- Remove hardcoded Redis password in databus_warm_cron.py; use env vars

Tests:
- Add tests/unit/core/test_ai_router.py (8 tests): model resolution, chat
  completion with mocked httpx, fallback to OpenRouter, no-provider error,
  streaming
- Add tests/unit/core/test_tracing.py (7 tests): setup_otel disabled/enabled,
  shutdown_otel, span helpers, tracing-enabled route registration
- Add tests/unit/core/test_langfuse.py (2 tests): no-env init, noop flush
- Fix tests/unit/domain/scanner/test_service.py to import from the moved
  app.domains.scanners.core.service

Result: 'ruff check .' passes with 0 errors (was 1470).
Pytest: 808 passed, 1 skipped (no regressions).

scripts/fix_security_lints.py

@@ -1,23 +1,41 @@
 #!/usr/bin/env python3
-"""Bulk-fix S110, S324, and S311 ruff violations in app/."""
+"""Bulk-fix S110, S324, and S311 ruff violations."""
+
 from __future__ import annotations
 
+import argparse
 import json
 import os
+import py_compile
 import re
 import subprocess
 import sys
-import py_compile
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parent.parent
-APP = ROOT / "app"
+DEFAULT_TARGETS = [ROOT / "app"]
+
+parser = argparse.ArgumentParser(description="Fix S110/S324/S311 ruff violations")
+parser.add_argument("targets", nargs="*", type=Path, default=DEFAULT_TARGETS)
+ARGS = parser.parse_args()
+TARGETS = [t if t.is_absolute() else ROOT / t for t in ARGS.targets]
 
 S110_LOG_LINE = 'logging.getLogger(__name__).warning("swallowed exception", exc_info=True)'
 
 
-def run_ruff(select: str) -> list[dict]:
-    cmd = [sys.executable, "-m", "ruff", "check", "--select", select, "--output-format", "json", str(APP)]
+def run_ruff(select: str, targets: list[Path] | None = None) -> list[dict]:
+    targets = targets or TARGETS
+    cmd = [
+        sys.executable,
+        "-m",
+        "ruff",
+        "check",
+        "--select",
+        select,
+        "--output-format",
+        "json",
+        *[str(t) for t in targets],
+    ]
     result = subprocess.run(cmd, capture_output=True, text=True)
     if result.returncode not in (0, 1):
         print(f"ruff {select} failed: {result.stderr}", file=sys.stderr)
@@ -72,8 +90,8 @@ SAME_LINE_PASS = re.compile(
 )
 
 
-def fix_s110() -> tuple[int, int]:
-    errors = run_ruff("S110")
+def fix_s110(targets: list[Path] | None = None) -> tuple[int, int]:
+    errors = run_ruff("S110", targets)
     by_file: dict[str, list[int]] = {}
     for e in errors:
         by_file.setdefault(e["filename"], []).append(e["location"]["row"])
@@ -132,8 +150,8 @@ NEW_MD5_RE = re.compile(r"hashlib\.new\s*\(\s*(['\"])md5\1\s*\)")
 NEW_SHA1_RE = re.compile(r"hashlib\.new\s*\(\s*(['\"])sha1\1\s*\)")
 
 
-def fix_s324() -> tuple[int, int]:
-    errors = run_ruff("S324")
+def fix_s324(targets: list[Path] | None = None) -> tuple[int, int]:
+    errors = run_ruff("S324", targets)
     by_file: dict[str, list[dict]] = {}
     for e in errors:
         by_file.setdefault(e["filename"], []).append(e)
@@ -145,8 +163,8 @@ def fix_s324() -> tuple[int, int]:
         orig = text
         text = MD5_RE.sub("hashlib.sha256(", text)
         text = SHA1_RE.sub("hashlib.sha256(", text)
-        text = NEW_MD5_RE.sub(r'hashlib.new(\1sha256\1)', text)
-        text = NEW_SHA1_RE.sub(r'hashlib.new(\1sha256\1)', text)
+        text = NEW_MD5_RE.sub(r"hashlib.new(\1sha256\1)", text)
+        text = NEW_SHA1_RE.sub(r"hashlib.new(\1sha256\1)", text)
         if text != orig:
             path.write_text(text)
             changed += 1
@@ -161,8 +179,8 @@ RANDOM_CALL_RE = re.compile(r"random\.((?:random|randint|uniform|randrange))\s*\
 RANDOM_CHOICE_RE = re.compile(r"random\.choice\s*\(")
 
 
-def fix_s311() -> tuple[int, int]:
-    errors = run_ruff("S311")
+def fix_s311(targets: list[Path] | None = None) -> tuple[int, int]:
+    errors = run_ruff("S311", targets)
     by_file: dict[str, list[dict]] = {}
     for e in errors:
         by_file.setdefault(e["filename"], []).append(e)
@@ -202,9 +220,10 @@ def verify_changed(files: list[Path]) -> list[str]:
 
 def main() -> None:
     os.chdir(ROOT)
-    s110_n, s110_files = fix_s110()
-    s324_n, s324_files = fix_s324()
-    s311_n, s311_files = fix_s311()
+    targets = TARGETS
+    s110_n, s110_files = fix_s110(targets)
+    s324_n, s324_files = fix_s324(targets)
+    s311_n, s311_files = fix_s311(targets)
     print(f"S110: {s110_n} errors -> touched {s110_files} files")
     print(f"S324: {s324_n} errors -> touched {s324_files} files")
     print(f"S311: {s311_n} errors -> touched {s311_files} files")
@@ -212,7 +231,9 @@ def main() -> None:
     # compile check every touched file
     changed = set()
     # collect all files that were touched via git status
-    proc = subprocess.run(["git", "status", "--short", str(APP)], capture_output=True, text=True)
+    proc = subprocess.run(
+        ["git", "status", "--short"] + [str(t) for t in targets], capture_output=True, text=True
+    )
     for ln in proc.stdout.splitlines():
         if ln.startswith(" M ") or ln.startswith("M  "):
             changed.add(ROOT / ln[3:].strip())