Mark four test-side bandit false positives

The PR gate reported four new alerts, all in test code. A fixture's
/tmp/x.3mf is a column value the migration under test UPDATEs, not a
path anything opens. Two f-string statements interpolate column names
from a literal list declared two lines above, with the id bound - a
column name cannot be a bind parameter, which is why it is written into
the string at all. The two joins move onto their own lines because a
trailing marker would have taken line 64 past the 120-character limit.

The fourth is a near miss rather than a finding: the line below it
already carries the marker, as do four other wildcard sites in the same
file. The wildcard is what that test exists to assert about.

backend/tests/integration/test_failure_reason_vocabulary_migration.py

@@ -27,7 +27,9 @@ from backend.app.models.print_log import PrintLogEntry
 # The columns each model needs beyond ``failure_reason``. Rows stay minimal on
 # purpose -- these tests exercise the UPDATE, not the schema.
 _REQUIRED = {
-    "PrintArchive": {"filename": "x.3mf", "file_path": "/tmp/x.3mf", "file_size": 1},
+    # nosec B108 - a column value, not a path anything opens. The row exists
+    # to be UPDATEd; nothing in these tests touches the filesystem.
+    "PrintArchive": {"filename": "x.3mf", "file_path": "/tmp/x.3mf", "file_size": 1},  # nosec B108
     "PrintLogEntry": {},
 }
 

backend/tests/integration/test_notifications_api.py

@@ -60,14 +60,21 @@ class TestNotificationsAPI:
         provider = await notification_provider_factory(name="Legacy Provider")
 
         flags = ["on_stock_reorder_alert", "on_stock_break_alert"]
+        # nosec B608 - the only interpolated fragments are built from `flags`,
+        # the literal list directly above. A column name cannot be a bind
+        # parameter, which is why it is written into the string at all; the id,
+        # which is the one caller-supplied value here, is bound.
+        null_assignments = ", ".join(f"{f} = NULL" for f in flags)
         await db_session.execute(
-            text(f"UPDATE notification_providers SET {', '.join(f'{f} = NULL' for f in flags)} WHERE id = :id"),
+            text(f"UPDATE notification_providers SET {null_assignments} WHERE id = :id"),  # nosec B608
             {"id": provider.id},
         )
         await db_session.commit()
 
+        columns = ", ".join(flags)
         stored = await db_session.execute(
-            text(f"SELECT {', '.join(flags)} FROM notification_providers WHERE id = :id"), {"id": provider.id}
+            text(f"SELECT {columns} FROM notification_providers WHERE id = :id"),  # nosec B608
+            {"id": provider.id},
         )
         assert all(value is None for value in stored.one()), "row under test must actually hold NULLs"
 

backend/tests/unit/test_vp_mqtt_bridge.py

@@ -1983,7 +1983,7 @@ class TestAdvertiseAddressOverride:
     def test_wildcard_override_falls_through_to_auto_resolve(self, monkeypatch):
         """0.0.0.0 is a bind address, never a destination — treat it as unset
         rather than encoding it and sending the slicer to 0.0.0.0."""
-        monkeypatch.setenv(self.ENV, "0.0.0.0")
+        monkeypatch.setenv(self.ENV, "0.0.0.0")  # nosec B104
         bridge = self._bound_bridge("0.0.0.0")  # nosec B104
         with patch(
             "backend.app.services.virtual_printer.mqtt_bridge._resolve_host_interface_for_target",