ai-readiness B1 — tighten mypy baseline

[jon-devlapaz]

Tighten the mypy baseline established in commit d456df8 so we can flip warn_return_any = True and warn_unreachable = True in mypy.ini. Each item is small and independent.

See AI_READINESS.md criterion B1 for the rubric context. Current baseline: mypy . exits 0 on 91 production files at the lenient v1 floor.

Checklist

• models/sketch_validation.py:115 — remove defensive if text is None: return False against a str-typed param. Per AGENTS.md anti-defensiveness rule ("don't add error handling for scenarios that can't happen"). Unblocks flipping warn_unreachable = True in mypy.ini.
• auth/session_seal.py:32 — Any-leak through dict[str, Any]-declared boundary. Fix with from typing import cast; return cast(dict[str, Any], json.loads(raw.decode("utf-8"))). Surface-area: 1 line.
• auth/router.py:788 → auth/service.py:293 load_session — Any-leak through the return-type chain. service.load_session is declared -> AuthSessionState but mypy treats state as Any at the return statement. Audit the typing chain (likely _get_auth_service(request) returns Any via FastAPI request.state). After fixes 2 + 3, flip warn_return_any = True in mypy.ini.
• scripts/snap.py:168 — real Path | None narrowing bug. Currently mypy-excluded via mypy.ini exclude block. Fix the narrowing, then remove scripts/ from the exclude list so dev tools are also gated.

Acceptance

• mypy . passes after each commit.
• mypy.ini has warn_return_any = True and warn_unreachable = True re-enabled (matching their original v1 intent).
• scripts/ is no longer excluded from the default mypy scope.

Refs

• Rubric: AI_READINESS.md (criterion B1).
• Baseline commit: `d456df8`.
• Anti-defensiveness: AGENTS.md "Execution discipline" section.