fix(#365): fix ruff, mypy, pip, and bandit issues in coordinator

- Fix 20 ruff errors: UP035 (Callable import), UP042 (StrEnum), E501
  (line length), F401 (unused imports), UP045 (Optional -> X | None),
  I001 (import sorting)
- Fix mypy error: wrap slowapi rate limit handler with
  Exception-compatible signature for add_exception_handler
- Pin pip >= 25.3 in Dockerfile (CVE-2025-8869, CVE-2026-1703)
- Add nosec B104 to config.py (container-bound 0.0.0.0 is acceptable)
- Add nosec B101 to telemetry.py (assert for type narrowing)
- Create bandit.yaml to suppress B404/B607/B603 in gates/ tooling

Fixes #365

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/coordinator/src/models.py

@@ -1,12 +1,12 @@
 """Data models for mosaic-coordinator."""
 
-from enum import Enum
+from enum import StrEnum
 from typing import Literal
 
 from pydantic import BaseModel, Field, field_validator
 
 
-class Capability(str, Enum):
+class Capability(StrEnum):
     """Agent capability levels."""
 
     HIGH = "high"
@@ -14,7 +14,7 @@ class Capability(str, Enum):
     LOW = "low"
 
 
-class AgentName(str, Enum):
+class AgentName(StrEnum):
     """Available AI agents."""
 
     OPUS = "opus"
@@ -24,7 +24,7 @@ class AgentName(str, Enum):
     MINIMAX = "minimax"
 
 
-class ContextAction(str, Enum):
+class ContextAction(StrEnum):
     """Actions to take based on context usage thresholds."""
 
     CONTINUE = "continue"  # Below compact threshold, keep working