refactor: sweep the platform-and-sign-in epic

Split load_config into per-section readers, use contextlib.suppress and a single condition where ruff asked, remove stale noqa comments, add the SIM and RUF100 rules, share the sign_in test helper, align AD-6 with the code and record the remaining deferred findings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

docker/healthcheck.py

@@ -6,11 +6,11 @@ import urllib.request
 
 hosts = [h.strip() for h in os.environ.get("ALLOWED_HOSTS", "").split(",") if h.strip()]
 host = hosts[0].lstrip(".") if hosts and hosts[0] != "*" else "localhost"
-request = urllib.request.Request(  # noqa: S310
+request = urllib.request.Request(
     "http://127.0.0.1:8000/healthz", headers={"Host": host}
 )
 try:
     with urllib.request.urlopen(request, timeout=3) as response:  # noqa: S310
         sys.exit(0 if response.status == 200 else 1)
-except Exception:  # noqa: BLE001
+except Exception:
     sys.exit(1)