Continue draining the mypy baseline established in #1331 — test suite + config tail

[JSv4]

Picks up the #1331 → #1335 → #1447 cadence. #1447 graduated the production-code packages (config.graphql.*, llms.*, shared.*, tasks.*, pipeline.*, utils.*, and corpuses/annotations/documents/agents/analyzer/discovery/conversations.*). What remains is the tail: a handful of production-code files plus the test suite.

mypy.ini currently has 220 ignore_errors blocks left to drain (docs/typing/mypy_baseline.txt ≈ 5,600 lines, down from the original 7,208).

Remaining surface

Production code (5 files — highest value, do first):

• config.settings.{base,local,test_integration}
• config.websocket.consumers.{thread_updates,unified_agent_conversation}

Worst-offender single file:

• opencontractserver.mcp.tests.test_mcp — ~319 errors, the single largest baseline file; explicitly deferred from typing: graduate opencontractserver.mcp.* from mypy baseline #1486. Heavy MagicMock usage — graduating it is a chance to audit for real bugs hidden behind auto-attribute mocks (the same pattern that hid bug Notification tests use MagicMock to hide bug in analyzer_name field path #1471).

Test suite (214 modules):

• opencontractserver.tests.permissioning.* — 18 modules
• opencontractserver.tests.websocket.* — 2 modules
• opencontractserver.tests.performance_optimizations.* — 2 modules
• opencontractserver.tests.* (leaf files) — ~192 modules

Suggested batching

1. Config tail — 1 PR for the 5 production-code files. Real runtime code, small surface.
2. test_mcp — 1 dedicated PR (large, audit-worthy).
3. tests.permissioning.* — 1 PR for the cohesive 18-file subpackage.
4. tests.* leaf files — chunk into 4–6 PRs grouped by domain (corpus / document / annotation / agent / extract / misc). Most share the same setUpTestData class-attribute pattern; see typing: graduate opencontractserver.discovery.tests.test_discovery_views from mypy baseline #1479 for the recommended lightest-touch fix.

Per-package workflow (unchanged from #1447)

1. Enumerate current errors for the package.
2. Fix or annotate (prefer real annotations over # type: ignore; where ignores are needed, scope them with an error code).
3. Remove the package's [mypy-...] block(s) from mypy.ini and prune the corresponding lines from docs/typing/mypy_baseline.txt.
4. Document the delta in CHANGELOG.md.

Acceptance

• Per-package PR(s) with the corresponding mypy.ini block(s) removed.
• Pre-commit mypy run on the full project surface continues to pass.
• Once all blocks above are cleared, only the permanent [mypy-*.migrations.*] wildcard and the three intentional disable_error_code = django-manager-missing blocks (users.models, annotations.models, documents.models) should remain — at which point the baseline is fully drained and docs/typing/mypy_baseline.txt can be removed.