chore(backend): mypy strict clean + ruff format pass

Pre-merge sanity per devops checklist (ruff format --check, mypy --strict).

Type fixes:
- ORM models: `Mapped[dict]` → `Mapped[dict[str, Any]]` (audit, scenario, run,
  report, ttp, detection.artifact_files_json). Equivalent on Pydantic DTOs
  (TtpBase.params_schema_json, ScenarioStepBase.params_override_json).
- Rename `TtpRead.current_version` → `TtpRead.version` to mirror the ORM
  column (which itself was renamed in D-009 cleanup).
- Flask blueprints: add `-> ResponseReturnValue` to every view, plus typed
  UUID params on `_validate_step_consistency`.
- `templating/filters.py`: rewrite the conditional re2 import so mypy can
  narrow the union (`ModuleType | None`); the runtime branch on `_re2 is not
  None` removes the unused-ignore that was triggered by warn_unused_ignores.
- `pyproject.toml`: add `flask_login.*` and `pythonjsonlogger.*` to the
  `[[tool.mypy.overrides]]` `ignore_missing_imports` list (both ship without
  typed marker).
- Misc: drop stale `# type: ignore` comments (`app.py:36`,
  `rbac/decorators.py:35`) flagged by `warn_unused_ignores`. Keep
  `logging.JsonFormatter` ignore because the symbol exists at runtime but is
  not re-exported through the typed surface.

Formatting:
- `ruff format` applied (15 files normalized; line-length unchanged at 100).

Verification on this commit:
- `ruff check`  → All checks passed.
- `ruff format --check` → 68 files already formatted.
- `mypy --strict src` → Success: no issues found in 54 source files.
- `pytest tests/unit` → 49 passed.

backend/src/mimic/api/hosts.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from flask import Blueprint, abort, jsonify
+from flask.typing import ResponseReturnValue
 from sqlalchemy import select
 
 from mimic.api._helpers import jsonify_model, parse_body, parse_uuid
@@ -24,7 +25,7 @@ def _engagement_or_404(eid: str) -> Engagement:
 
 @bp.get("/engagements/<eid>/hosts")
 @require_perm(Permission.HOST_CRUD)
-def list_hosts(eid: str):
+def list_hosts(eid: str) -> ResponseReturnValue:
     engagement = _engagement_or_404(eid)
     stmt = select(Host).where(Host.engagement_id == engagement.id).order_by(Host.hostname)
     rows = db.session.execute(stmt).scalars().all()
@@ -33,7 +34,7 @@ def list_hosts(eid: str):
 
 @bp.post("/engagements/<eid>/hosts")
 @require_perm(Permission.HOST_CRUD)
-def create_host(eid: str):
+def create_host(eid: str) -> ResponseReturnValue:
     engagement = _engagement_or_404(eid)
     payload = parse_body(HostCreate)
     host = Host(
@@ -52,7 +53,7 @@ def create_host(eid: str):
 
 @bp.put("/engagements/<eid>/hosts/<hid>")
 @require_perm(Permission.HOST_CRUD)
-def update_host(eid: str, hid: str):
+def update_host(eid: str, hid: str) -> ResponseReturnValue:
     engagement = _engagement_or_404(eid)
     host = db.session.get(Host, parse_uuid(hid, field="host id"))
     if host is None or host.engagement_id != engagement.id:
@@ -66,7 +67,7 @@ def update_host(eid: str, hid: str):
 
 @bp.delete("/engagements/<eid>/hosts/<hid>")
 @require_perm(Permission.HOST_CRUD)
-def delete_host(eid: str, hid: str):
+def delete_host(eid: str, hid: str) -> ResponseReturnValue:
     engagement = _engagement_or_404(eid)
     host = db.session.get(Host, parse_uuid(hid, field="host id"))
     if host is None or host.engagement_id != engagement.id: