refactor: sweep the platform-and-sign-in epic

Split load_config into per-section readers, use contextlib.suppress and a single condition where ruff asked, remove stale noqa comments, add the SIM and RUF100 rules, share the sign_in test helper, align AD-6 with the code and record the remaining deferred findings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/adapters/directory/ldap_directory.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import logging
 import re
-from contextlib import contextmanager
+from contextlib import contextmanager, suppress
 from dataclasses import replace
 from datetime import UTC, datetime, timedelta
 from types import ModuleType
@@ -105,10 +105,8 @@ class LdapDirectory:
             logger.warning("Directory request failed: %s", type(exc).__name__)
             raise DirectoryUnavailable("The directory is not available") from exc
         finally:
-            try:
+            with suppress(self._ldap.LDAPError):
                 conn.unbind_s()
-            except self._ldap.LDAPError:
-                pass
 
     def _search(self, conn, base: str, scope: int, flt: str, attrs: tuple[str, ...]):
         found = conn.search_s(base, scope, flt, list(attrs))
@@ -203,10 +201,8 @@ class LdapDirectory:
             logger.warning("Directory request failed: %s", type(exc).__name__)
             raise DirectoryUnavailable("The directory is not available") from exc
         finally:
-            try:
+            with suppress(ldap.LDAPError):
                 user_conn.unbind_s()
-            except ldap.LDAPError:
-                pass
 
     def password_policy(self, sam: str) -> PasswordPolicy:
         ldap = self._ldap