V4.6 Phase 7: drive ty check to zero and add a blocking quality gate [HIGH-06]

Baseline was 207 diagnostics. Two real bugs were hiding in the noise:

- tools/run_destructive_tests.py imported ctypes.wintypes at module scope,
  which raises on non-Windows, and called fcntl unconditionally. The Windows
  and POSIX implementations now live under a module-level sys.platform split.
- tests/ui/test_sources_page.py constructed Source(...) without document_id.

Structural fixes, not suppressions:

- New src/transcription/db/loading.py owns the SQLModel-field to
  QueryableAttribute reinterpretation via orm_attribute()/selectinload()/
  defer(). This removed 42 "# pyright: ignore[reportArgumentType]" comments
  across documents/jobs/people/sources. Its docstring records that
  selectinload(A.b, B.c) is NOT equivalent to the chained form: varargs
  applies the selectin strategy only to the last path element, which under
  lazy="raise" raises InvalidRequestError at render time.
- db/session.py transaction_scope no longer accepts or yields
  AsyncSessionTransaction. No caller ever passed one, sessionmaker.begin()
  yields an AsyncSession, and the dead branch was latently buggy because
  services call .exec(). Cleared 7 workflows.py diagnostics.
- services/registry.py RegistryService is bound by a new RegistryEntry
  Protocol instead of bare SQLModel, so the shared implementation can read
  id/label/normalized_label/is_active. Cleared 9 diagnostics.
- Column expressions in sources.py/jobs.py/test_store.py wrap in sqlmodel
  col(), the idiom already used in registry.py.
- read_source_navigation wraps its literal tuple bounds in literal().
- normalization.py narrows with isinstance(image, TiffImageFile) rather than
  comparing image.format, since tag_v2 is TIFF-only.
- linked_people.render uses @ui.refreshable_method, the NiceGUI API for bound
  methods.
- The OpenRouter capturing client re-raises ResponseNotRead when the response
  stream is not async rather than mis-wrapping it.

Tooling gate:

- New .pre-commit-config.yaml runs ruff check and ty check as blocking hooks.
  No pre-commit config previously existed. Negative-tested: injecting a type
  error fails both hooks.
- The last two "# pyright: ignore" comments (config.py) are removed; ty does
  not honor pyright directives. One "# ty: ignore" remains, in
  tests/test_prompts.py, where the test deliberately assigns to a frozen
  field to assert ValidationError.
- asyncio_default_fixture_loop_scope is pinned to "function" so
  pytest-asyncio behavior does not shift on upgrade.

Verification: ruff check clean, ty check reports 0 diagnostics, 292 passed
and 4 skipped, pre-commit passes and demonstrably fails on a regression, and
tools/run_destructive_tests.py runs on Windows.

Co-authored-by: Copilot App <[email protected]>

tests/providers/test_openrouter.py

@@ -2,8 +2,10 @@
 
 import asyncio
 from types import SimpleNamespace
+from typing import cast
 
 import pytest
+from openrouter import OpenRouter
 
 from transcription.config import Settings
 from transcription.providers.base import ProviderError
@@ -13,7 +15,7 @@ from transcription.providers.openrouter import OpenRouterTranscriptionProvider
 
 
 class _FakeChat:
-    def __init__(self, response=None, error: Exception | None = None):
+    def __init__(self, response=None, error: BaseException | None = None):
         self._response = response
         self._error = error
         self.calls = []
@@ -26,10 +28,15 @@ class _FakeChat:
 
 
 class _FakeClient:
-    def __init__(self, response=None, error: Exception | None = None):
+    def __init__(self, response=None, error: BaseException | None = None):
         self.chat = _FakeChat(response=response, error=error)
 
 
+def _fake_client(response=None, error: BaseException | None = None) -> OpenRouter:
+    """Return a stub typed as the SDK client the provider declares."""
+    return cast("OpenRouter", _FakeClient(response=response, error=error))
+
+
 @pytest.mark.unit
 class TestOpenRouterProviderInit:
     """Verify OpenRouter provider initialization behavior."""
@@ -37,13 +44,13 @@ class TestOpenRouterProviderInit:
     def test_model_falls_back_to_default_when_unset(self):
         """Provider uses adapter default model when provider_model is None."""
         settings = Settings(openrouter_api_key="test-key", provider_model=None)
-        provider = OpenRouterTranscriptionProvider(settings=settings, client=_FakeClient())
+        provider = OpenRouterTranscriptionProvider(settings=settings, client=_fake_client())
         assert provider.model == DEFAULT_OPENROUTER_MODEL
 
     def test_model_uses_configured_value(self):
         """Provider uses configured provider_model when present."""
         settings = Settings(openrouter_api_key="test-key", provider_model="vendor/custom-model")
-        provider = OpenRouterTranscriptionProvider(settings=settings, client=_FakeClient())
+        provider = OpenRouterTranscriptionProvider(settings=settings, client=_fake_client())
         assert provider.model == "vendor/custom-model"
 
 
@@ -61,7 +68,7 @@ class TestOpenRouterProviderTranscribe:
             openrouter_http_referer="https://example.test",
             openrouter_app_title="Transcription App",
         )
-        provider = OpenRouterTranscriptionProvider(settings=settings, client=client)
+        provider = OpenRouterTranscriptionProvider(settings=settings, client=cast("OpenRouter", client))
 
         result = await provider.transcribe(
             prompt_text="Prompt body",
@@ -79,7 +86,10 @@ class TestOpenRouterProviderTranscribe:
         """Transcribe passes configured sampling parameters through to OpenRouter."""
         response = {"model": "vendor/model-a", "choices": [{"message": {"content": "Transcript text"}}]}
         client = _FakeClient(response=response)
-        provider = OpenRouterTranscriptionProvider(settings=Settings(openrouter_api_key="test-key"), client=client)
+        provider = OpenRouterTranscriptionProvider(
+            settings=Settings(openrouter_api_key="test-key"),
+            client=cast("OpenRouter", client),
+        )
 
         result = await provider.transcribe(
             prompt_text="Prompt body",
@@ -110,7 +120,7 @@ class TestOpenRouterProviderTranscribe:
         }
         provider = OpenRouterTranscriptionProvider(
             settings=Settings(openrouter_api_key="test-key"),
-            client=_FakeClient(response=response),
+            client=_fake_client(response=response),
         )
 
         result = await provider.transcribe(
@@ -134,7 +144,7 @@ class TestOpenRouterProviderTranscribe:
         """Transcribe converts SDK failures to ProviderError."""
         provider = OpenRouterTranscriptionProvider(
             settings=Settings(openrouter_api_key="test-key"),
-            client=_FakeClient(error=RuntimeError("network down")),
+            client=_fake_client(error=RuntimeError("network down")),
         )
 
         with pytest.raises(ProviderError):
@@ -149,7 +159,7 @@ class TestOpenRouterProviderTranscribe:
         """Caller and shutdown cancellation must not be relabeled as a timeout."""
         provider = OpenRouterTranscriptionProvider(
             settings=Settings(openrouter_api_key="test-key"),
-            client=_FakeClient(error=asyncio.CancelledError()),
+            client=_fake_client(error=asyncio.CancelledError()),
         )
 
         with pytest.raises(asyncio.CancelledError):
@@ -166,7 +176,7 @@ class TestOpenRouterProviderTranscribe:
         client = _FakeClient(response=response)
         provider = OpenRouterTranscriptionProvider(
             settings=Settings(openrouter_api_key="test-key"),
-            client=client,
+            client=cast("OpenRouter", client),
         )
 
         await provider.transcribe(
@@ -185,7 +195,7 @@ class TestOpenRouterProviderTranscribe:
         """Transcribe raises ProviderResponseError for missing completion text."""
         provider = OpenRouterTranscriptionProvider(
             settings=Settings(openrouter_api_key="test-key"),
-            client=_FakeClient(response=SimpleNamespace(choices=[])),
+            client=_fake_client(response=SimpleNamespace(choices=[])),
         )
 
         with pytest.raises(ProviderResponseError):
@@ -204,7 +214,7 @@ class TestOpenRouterProviderTranscribe:
         }
         provider = OpenRouterTranscriptionProvider(
             settings=Settings(openrouter_api_key="test-key"),
-            client=_FakeClient(response=response),
+            client=_fake_client(response=response),
         )
 
         result = await provider.transcribe(