backend: remove __main__ runner; typing: fix mypy across core and routes; tooling: use uv for pytest in pre-commit; security: narrow broad except in config; mypy: relax untyped decorator check for backend.app.main

backend/app/core/config.py

@@ -207,7 +207,7 @@ class Settings:
             parsed = self._parse_list("CORS_ORIGINS", [])
             if parsed:
                 return parsed
-        except Exception:
+        except (ValueError, SyntaxError, json.JSONDecodeError, TypeError):
             # Fall back to comma-separated parsing if JSON/literal parsing fails
             pass