13 pre-existing mypy errors across core/security modules

[magi8101]

Found while wiring up CI (#3) — mypy runs advisory-only in CI for now since these aren't related to that PR's scope:

velocix/core/router.py:280,282 — Callable has no attribute __route_tags__
velocix/core/depends.py:278 — None has no attribute __metadata__
velocix/security/base.py:162 — returning Any from function declared to return Response
velocix/core/app.py:91 — returning Any from function declared to return bytes | None
velocix/core/app.py:891,893 — CachedRoute/Callable type mismatch in docs route dict
velocix/core/app.py:945,978 — html.escape() given str | None
velocix/security/jwt.py:223 — dict[str, bool] vs Options | None for jwt.decode options
velocix/security/brute_force.py:150,153,157 — StorageBackend has no incr_sync/reset_sync (these are monkey-patched onto MemoryBackend at runtime via _patch_backend(), invisible to mypy)

Once these are cleared, flip CI's mypy step from advisory (|| true) to gating.

[magi8101]

Fixed in #11 — 0 mypy errors now, and CI's mypy step is gating instead of advisory.

[magi8101]

mypy velocix reports 0 errors on current main (verified in a fresh venv) — all fixed in #11, #13, #14 along the way. CI's mypy step is gating, not advisory.