build(backend): close the lint gaps the E32 audit measured

ruff gains RUF100, PLW1510 and flake8-bugbear, every hit fixed rather than
ignored. B008 stays on with FastAPI's Depends/Query declared immutable.
basedpyright moves to standard mode, pytest to --strict-markers, and a hand
run of pytest now requires the database unless SIFTLODE_TEST_REQUIRE_DB=0.

PLW1510 found a real bug: the three ffprobe probes in plex/stream.py never
looked at the exit status, so a probe that failed was read as the file's
truth (an HDR source sent down the HW-safe path, a multi-audio file collapsed
to one track, a subtitle offset taken from garbage) and the warning each
except branch promises never fired. They now run with check=True.

scripts/e2e_seed.py

@@ -21,10 +21,10 @@ from datetime import datetime, timezone
 
 sys.path.insert(0, "/app")
 
-from sqlalchemy import delete, func, select  # noqa: E402
+from sqlalchemy import delete, func, select
 
-from app.db import SessionLocal  # noqa: E402
-from app.models import (  # noqa: E402
+from app.db import SessionLocal
+from app.models import (
     AppState,
     Channel,
     Playlist,
@@ -34,7 +34,7 @@ from app.models import (  # noqa: E402
     Video,
     VideoState,
 )
-from app.security import hash_password  # noqa: E402
+from app.security import hash_password
 
 EMAIL = os.environ.get("E2E_EMAIL", "e2e@siftlode.local")
 PASSWORD = os.environ.get("E2E_PASSWORD", "")
@@ -171,7 +171,7 @@ def main() -> None:
                 saved = svid.id
         db.commit()
 
-        # noqa T201: this script's stdout IS its interface — the e2e runner parses this JSON.
+        # T201: this script's stdout IS its interface — the e2e runner parses this JSON.
         print(  # noqa: T201
             json.dumps(
                 {