fix: resolve all ruff lint errors and type checker warnings

- Use Annotated[str, Form()] for FastAPI dependencies (FAST002)
- Add missing type annotations across src/ and tests/ (ANN001/003/201/202)
- Reduce function arguments via request.form() reads (PLR0913)
- Combine return paths to reduce return statements (PLR0911)
- Use anyio.Path for async-safe filesystem operations (ASYNC240)
- Extract constants, helpers, and dict comprehensions for clarity
- Move inline imports to top-level (PLC0415)
- Use raw strings for regex match patterns (RUF043)
- Fix redundant get_session_user call in delete_user (not-iterable)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/test_oidc/test_consent_flow.py

@@ -3,6 +3,7 @@ from datetime import UTC, datetime
 from urllib.parse import parse_qs, urlparse
 
 from argon2 import PasswordHasher
+from fastapi import FastAPI
 from httpx import AsyncClient
 
 from porchlight.authn.password import PasswordService
@@ -225,7 +226,7 @@ async def test_partial_consent_filters_scopes(client: AsyncClient) -> None:
 # -- Test helpers --
 
 
-def _register_test_rp(app) -> None:
+def _register_test_rp(app: FastAPI) -> None:
     oidc_server = app.state.oidc_server
     if "consent-rp" in oidc_server.context.cdb:
         return
@@ -244,7 +245,7 @@ def _register_test_rp(app) -> None:
     oidc_server.keyjar.add_symmetric(client_id, client_secret)
 
 
-async def _create_test_user(app) -> None:
+async def _create_test_user(app: FastAPI) -> None:
     user_repo = app.state.user_repo
     existing = await user_repo.get_by_username("consentuser")
     if existing: