ci: mypy ratchet -- keep type-clean modules clean (71 modules, 536 -> 442 errors) (#661)

* ci: mypy ratchet -- keep type-clean modules clean

mypy-clean.txt lists the 71 modules under src/ that type-check clean;
scripts/check_types.py runs mypy (--follow-imports=silent) on exactly
those files and fails on any error or a missing/unsorted/duplicate entry.
A new "Type check (mypy ratchet)" CI job runs it with mypy 1.20.2 and
pinned stubs; the manual pre-commit mypy hook now runs the same script
(a local hook, so mypy sees the installed requirements like CI does).

35 modules were made clean with annotation-only fixes: hints, typing.cast,
TYPE_CHECKING imports, implicit-Optional defaults made explicit, and
annotations widened (never guards removed) where mypy called a defensive
isinstance check unreachable. No runtime behaviour change.

mypy.ini: numpy and orjson are treated as Any (follow_imports=skip, also
for stubs). numpy 2.3+ stubs use 3.12 `type` statements that mypy won't
parse at python_version 3.10, and orjson is optional, so seeing its stubs
made the result depend on whether it was installed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: annotate check_types.py's list-form mypy subprocess

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

src/web_interface/api_helpers.py

@@ -109,7 +109,7 @@ def exception_error_response(
     )
 
 
-def validate_request_json(required_fields: list, data: Optional[Dict] = None) -> Tuple[Optional[Dict], Optional[Any]]:
+def validate_request_json(required_fields: list, data: Any = None) -> Tuple[Optional[Dict], Optional[Any]]:
     """
     Validate request JSON has required fields.
     

src/web_interface/config_arrays.py

@@ -30,7 +30,7 @@ def _is_index_dict(value: Any) -> bool:
     return isinstance(value, dict) and all(str(k).isdigit() for k in value)
 
 
-def coerce_array_shapes(config: Dict[str, Any], schema_props: Dict[str, Any],
+def coerce_array_shapes(config: Any, schema_props: Dict[str, Any],
                         short_lists_take_default: bool = False) -> None:
     """Turn position-keyed dicts into lists wherever the schema has an array.
 
@@ -64,7 +64,7 @@ def coerce_array_shapes(config: Dict[str, Any], schema_props: Dict[str, Any],
                     and len(value) < min_items
                     and isinstance(default, list) and len(default) >= min_items):
                 value = config[key] = list(default)
-            items_schema = prop_schema.get('items')
+            items_schema: Any = prop_schema.get('items')
             if (_schema_type_is(items_schema, 'object')
                     and 'properties' in items_schema):
                 for element in value:

src/web_interface/error_handler.py

@@ -152,7 +152,7 @@ def create_success_response(
     Returns:
         Dictionary for jsonify
     """
-    response = {
+    response: dict[str, Any] = {
         "status": "success"
     }
     

src/web_interface/errors.py

@@ -142,7 +142,7 @@ class WebInterfaceError:
     
     def to_dict(self) -> Dict[str, Any]:
         """Convert error to dictionary for JSON response."""
-        result = {
+        result: Dict[str, Any] = {
             "status": "error",
             "error_code": self.error_code.value,
             "message": self.message,

src/web_interface/secret_helpers.py

@@ -5,10 +5,10 @@ Provides functions for identifying, masking, separating, and filtering
 secret fields in plugin configurations based on JSON Schema x-secret markers.
 """
 
-from typing import Any, Dict, Optional, Set, Tuple
+from typing import Any, Dict, Optional, Set, Tuple, cast
 
 
-def find_secret_fields(properties: Dict[str, Any], prefix: str = '') -> Set[str]:
+def find_secret_fields(properties: Any, prefix: str = '') -> Set[str]:
     """Find all fields marked with ``x-secret: true`` in a JSON Schema properties dict.
 
     Recurses into nested objects and array items to discover secrets at any
@@ -336,4 +336,4 @@ def _contains_mask(value: Any) -> bool:
         return any(_contains_mask(v) for v in value.values())
     if isinstance(value, list):
         return any(_contains_mask(item) for item in value)
-    return value == SECRET_MASK
+    return cast(bool, value == SECRET_MASK)