Pre-existing code quality findings from Ruff PR review

[nitrobass24]

Summary

During the Ruff linting PR (#288) review, several pre-existing code quality issues were identified. None were introduced by the Ruff changes.

Findings to address

Real bugs

• Busy-wait CPU spike on shutdown (common/app_process.py:114-115) — while self.is_alive(): pass burns CPU. Fix: add self.join(timeout=0.1) or time.sleep(0.05) inside the loop.

• Race condition on queue internals (controller/extract/dispatch.py:104-112) — list(self.__task_queue.queue) reads the raw deque without holding the queue mutex. Fix: wrap with with self.__task_queue.mutex:.

• user=None produces "None@host" (ssh/sshcp.py:31-38) — Constructor accepts user=None but callers format "{user}@{host}" unconditionally. Fix: add a _remote_target() helper that omits user when None.

• Wrong boolean in wait loop (tests/unittests/test_controller/test_extract/test_dispatch.py:704-705) — Uses and instead of or, causing premature exit. Fix: change to while ... < 1 or ... < 1.

Minor / resource leaks

• urlopen not closed (controller/notifier.py:114-115) — Response not in context manager on success path. Minor socket leak.

• Popen not awaited, fnull not closed (tests/integration/test_controller/test_extract/test_extract.py:49-64) — Archive creation subprocesses may not finish before tests run. Fix: use subprocess.run() or call .wait().

• fnull not closed (tests/integration/test_controller/test_controller.py:86-87) — open(os.devnull) not in with block.

Design / behavior

• os.replace strips permissions (common/persist.py:75-81) — mkstemp creates 0600 files; os.replace transfers those permissions. Fix: preserve original file mode before replace.

• no-enabled-pairs fallback logic (controller/controller.py:285-299) — When all pairs are disabled, no_enabled_pairs flag is set but a default pair still syncs. May be intentional — needs product decision.

• os.path.join for remote POSIX paths (controller/scan/remote_scanner.py:45-47) — Uses host OS path separator for SSH remote paths. Fix: use posixpath.join. Low risk since app only runs in Linux Docker.

Not fixing (verified non-issues)

• logger None in except (seedsync.py:478) — Logger is always initialized before run().
• Joining unstarted threads (notifier.py:64) — Threads are only added after .start().
• isdir check too broad (local_scanner.py:32) — Theoretical only.

[nitrobass24]

Additional findings from v0.14.1 release review

Adding pre-existing items surfaced during the release PR review that aren't covered above:

Minor / defensive

• logs.py negative before param — The parsed before query param can be negative, filtering out all entries. Clamp to 0 after parsing.
• logs.py readlines memory — f.readlines() loads entire log file into memory. Use streaming iteration or deque(maxlen=...) for large/rotated logs.
• scanner.py empty suffix validation — set_lftp_temp_suffix("") would make slicing logic match everything. Validate input is non-empty.
• web/utils.py None sentinel collision — get_next_event returns None for empty queue, colliding with a real None event. Use a unique sentinel object.
• stream_model.py assert vs raise — assert self.initial_model_files is not None in get_value can be stripped by Python optimizations. Use explicit if/raise.
• web_app_job.py assert-based flow and unbounded join — stop()/cleanup() use assertions for flow control and join() has no timeout.

[nitrobass24]

Additional finding: Config validation helper for controller.py

controller.py has 41 # type: ignore[arg-type] lines where Config dynamic properties (Any | None) flow into functions expecting concrete types (str, int, bool). Instead of suppressing these, add a _validate_required_config() helper that checks all required config fields at the top of _create_pair_context and raises ConfigError with clear messages for missing values. This would:

1. Replace 41 type-ignore comments with a single validation call
2. Fail fast with a clear error message instead of None-related crashes downstream
3. Allow Pyright to narrow the types after validation

This is a behavioral change (adds runtime validation) so it should be its own PR, not part of the type-fix work.