refactor(types): add comprehensive type annotations across backend Python codebase

Enable ANN rules in ruff.toml (flake8-annotations) and resolve all 221 violations:

ANN201/ANN202 — return types on 168 public/private functions:
- All 28 FastAPI routers: endpoints annotated with dict/list/specific schema/
  StreamingResponse/FileResponse/JSONResponse as appropriate
- main.py: lifespan→AsyncGenerator[None,None], exception handlers→JSONResponse
- database.py: get_db→Generator[Session,None,None], proxy methods→correct types
- middleware/request_context.py: dispatch→Response with Callable call_next type

ANN001/ANN002/ANN003 — 32 missing argument types:
- seed_demo.py: all db parameters typed as Session
- domain/unit_of_work.py: __aexit__ exc_type/exc_val/exc_tb typed with TracebackType
- services: audit_service user_id→UUID|None, heatmap_service query/model/builder,
  notification_service test→Test, tempo_service test→Test/user→User,
  test_workflow_service test_id→UUID, campaign_crud **fields→object,
  test_crud **fields→object (4 sites)

ANN401 — 16 Any usages resolved:
- Domain entities (campaign/technique/threat_actor/test_entity): replaced Any with
  actual ORM types via TYPE_CHECKING guards to avoid circular imports
- detection_rule_service: test_id/detection_rule_id/evaluator_id→UUID
- score_cache: kept Any with # noqa: ANN401 (genuinely generic cache)
- jira_service/tempo_service: kept Any with # noqa: ANN401 (lazy optional deps)
- d3fend_import_service: _to_str(v: Any) kept with # noqa: ANN401

ANN204/ANN205/ANN206 — special/static/class methods:
- database.py proxy __call__/__getattr__: *args: object/**kwargs: object
- schemas/test.py model_validate: obj→object, **kwargs→object
- sa_technique_repository._int_type→type

All 439 unit tests pass. ruff check app/ → All checks passed!

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/heatmap_service.py

@@ -10,9 +10,10 @@ no ``db.commit()``.
 from __future__ import annotations
 
 import json
+from collections.abc import Callable
 
 from sqlalchemy import func, or_
-from sqlalchemy.orm import Session
+from sqlalchemy.orm import Query, Session
 
 from app.domain.errors import BusinessRuleViolation, EntityNotFoundError
 from app.models.campaign import Campaign, CampaignTest
@@ -92,11 +93,11 @@ def _build_layer_skeleton(
 
 
 def _apply_filters(
-    query,
-    model,
+    query: Query,  # type: ignore[type-arg]
+    model: type,
     platforms: list[str] | None = None,
     tactics: list[str] | None = None,
-):
+) -> Query:  # type: ignore[type-arg]
     """Apply common platform and tactic filters to a technique query."""
     if platforms:
         platform_filters = [
@@ -470,7 +471,7 @@ class _LayerRegistry:
         self._simple: dict[str, object] = {}
         self._with_id: dict[str, object] = {}
 
-    def register(self, name: str, builder, *, requires_id: bool = False) -> None:
+    def register(self, name: str, builder: Callable[..., dict], *, requires_id: bool = False) -> None:
         target = self._with_id if requires_id else self._simple
         target[name] = builder
 
@@ -513,7 +514,7 @@ LAYER_REGISTRY.register("campaign", build_campaign_layer, requires_id=True)
 SUPPORTED_LAYER_TYPES = LAYER_REGISTRY.supported_types  # snapshot of built-in types
 
 
-def register_layer(name: str, builder, *, requires_id: bool = False) -> None:
+def register_layer(name: str, builder: Callable[..., dict], *, requires_id: bool = False) -> None:
     """Public API to register a new heatmap layer type at import time."""
     LAYER_REGISTRY.register(name, builder, requires_id=requires_id)