fix(api): mypy no-redef and no-any-return errors on dev (CAR-1335)

The api typecheck job is continue-on-error but still posts a failure
status that blocks merges. Three pre-existing mypy errors on dev were
inherited by every PR based on it:

1. middleware/rate_limit.py: duplicate 'name already defined' for
   _public_limiter, _auth_limiter, _auth_strict_limiter (declared at
   lines 111-113 and again at 124-126). The second set is redundant
   because actual assignment happens inside the if/else below.
2. cache.py:43 - 'Returning Any' from .get(); the redis client's get()
   return type isn't narrowed to bytes|str, so the final 'return value'
   branch is Any. Wrap with str() to satisfy the declared str|None.
3. middleware/rate_limit.py:150 - 'Returning Any' from _get_client_ip.
   request.headers.get() and request.client.host are typed Any; wrap
   the branches with str() to match the declared str return.

Refs CAR-1335.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

src/cartsnitch_api/cache.py

@@ -40,7 +40,7 @@ class CacheClient:
             return None
         if isinstance(value, bytes):
             return value.decode("utf-8", errors="replace")
-        return value
+        return str(value)
 
     async def set(self, key: str, value: str, ttl_seconds: int = 300) -> None:
         if not self._client:

src/cartsnitch_api/middleware/rate_limit.py

@@ -121,10 +121,6 @@ if settings.rate_limit_redis_enabled:
         logger.warning("Failed to connect to Redis for rate limiting, using in-memory: %s", e)
         _use_redis = False
 
-_public_limiter: RateLimitBackend
-_auth_limiter: RateLimitBackend
-_auth_strict_limiter: RateLimitBackend
-
 if _use_redis and _redis_client:
     _public_limiter = RedisSlidingWindow(
         _redis_client, settings.rate_limit_requests, settings.rate_limit_window_seconds
@@ -151,8 +147,8 @@ def _get_client_ip(request: Request) -> str:
     """Extract client IP, respecting X-Forwarded-For behind a reverse proxy."""
     forwarded = request.headers.get("x-forwarded-for")
     if forwarded:
-        return forwarded.split(",")[0].strip()
-    return request.client.host if request.client else "unknown"
+        return str(forwarded.split(",")[0].strip())
+    return str(request.client.host) if request.client else "unknown"
 
 
 def _get_rate_limit_key(request: Request) -> tuple[str, RateLimitBackend]:

tests/conftest.py

@@ -117,7 +117,6 @@ def _register_event_listeners():
             event.listen(cls, "before_insert", _set_timestamp_defaults)
 
 
-
 TEST_JWT_SECRET = secrets.token_urlsafe(32)
 TEST_SERVICE_KEY = secrets.token_urlsafe(32)
 TEST_FERNET_KEY = "7reF42nmTwbdN21PBoubGp7h_FU8qSimstmlaMLoRK8="

tests/test_openapi.py

@@ -18,6 +18,7 @@ def test_dispose_engine_importable_from_database():
     assert callable(dispose_engine)
     assert dispose_engine.__name__ == "dispose_engine"
 
+
 EXPECTED_ROUTES = [
     # Auth (3 — register/login/refresh are handled by Better-Auth service)
     ("get", "/auth/me"),