Increase ruff coverage (#23644)

* Pin ruff

* Add python upgrade fixes

This enables python upgrade checks in ruff to look for deprecated types and patterns. This namely fixes:
- usage of deprecated `Typing` which is now built in
- some specific exceptions which are caught and have new aliases

Some specific UP checks were also ignored as they are stylistic / unimportant and likely to cause bugs

* Remove async blocking calls

Use asyncio.to_thread on two remaining blocking calls to fix hanging event thread loop. Enable this specific rule to block it in the future.

* Use proper logging mechanism

* Correctly format logs

* Raise with context

When raising an exception include the from context to improve debugging

* Cleanup

frigate/api/media_auth.py

@@ -14,7 +14,6 @@ from __future__ import annotations
 import logging
 import os
 from enum import Enum
-from typing import Optional
 from urllib.parse import unquote, urlparse
 
 from peewee import DoesNotExist
@@ -42,7 +41,7 @@ class MediaAuthResolution(str, Enum):
     UNKNOWN = "unknown"
 
 
-def extract_path(original_url: Optional[str]) -> Optional[str]:
+def extract_path(original_url: str | None) -> str | None:
     """Return the decoded path component of nginx's `X-Original-URL` header.
 
     nginx forwards the *raw* request URI (with `..` segments intact) via
@@ -72,8 +71,8 @@ def extract_path(original_url: Optional[str]) -> Optional[str]:
 
 
 def resolve_media_uri(
-    uri: str, frigate_config: Optional[FrigateConfig] = None
-) -> tuple[MediaAuthResolution, Optional[str]]:
+    uri: str, frigate_config: FrigateConfig | None = None
+) -> tuple[MediaAuthResolution, str | None]:
     """Classify a URI and return the owning camera if applicable.
 
     `frigate_config` is used to disambiguate clip/review filenames whose
@@ -100,7 +99,7 @@ def resolve_media_uri(
 
 def _resolve_recording(
     parts: list[str],
-) -> tuple[MediaAuthResolution, Optional[str]]:
+) -> tuple[MediaAuthResolution, str | None]:
     # /recordings                          → neutral
     # /recordings/{date}                   → neutral
     # /recordings/{date}/{hour}            → multi-camera listing
@@ -113,8 +112,8 @@ def _resolve_recording(
 
 
 def _resolve_clip(
-    parts: list[str], frigate_config: Optional[FrigateConfig]
-) -> tuple[MediaAuthResolution, Optional[str]]:
+    parts: list[str], frigate_config: FrigateConfig | None
+) -> tuple[MediaAuthResolution, str | None]:
     # /clips                                          → multi-camera listing
     # /clips/thumbs/{cam}/...                         → camera
     # /clips/previews/{cam}/...                       → camera
@@ -159,8 +158,8 @@ def _resolve_clip(
 
 
 def _longest_prefix_camera(
-    stem: str, frigate_config: Optional[FrigateConfig]
-) -> Optional[str]:
+    stem: str, frigate_config: FrigateConfig | None
+) -> str | None:
     if frigate_config is None:
         return None
     for cam in sorted(frigate_config.cameras.keys(), key=len, reverse=True):
@@ -170,8 +169,8 @@ def _longest_prefix_camera(
 
 
 def _camera_from_clip_filename(
-    filename: str, frigate_config: Optional[FrigateConfig]
-) -> Optional[str]:
+    filename: str, frigate_config: FrigateConfig | None
+) -> str | None:
     """Match a flat clip filename `{camera}-{event_id}[-clean].{ext}` against
     configured camera names. Longest-prefix wins so camera names containing
     hyphens (e.g. `front-door`) resolve correctly.
@@ -182,8 +181,8 @@ def _camera_from_clip_filename(
 
 
 def _camera_from_thumb_filename(
-    filename: str, frigate_config: Optional[FrigateConfig]
-) -> Optional[str]:
+    filename: str, frigate_config: FrigateConfig | None
+) -> str | None:
     """Match a review thumbnail filename `thumb-{camera}-{review_id}.webp`."""
     if not filename.startswith("thumb-"):
         return None
@@ -194,7 +193,7 @@ def _camera_from_thumb_filename(
 
 def _resolve_export(
     parts: list[str],
-) -> tuple[MediaAuthResolution, Optional[str]]:
+) -> tuple[MediaAuthResolution, str | None]:
     # /exports                  → multi-camera listing
     # /exports/{filename}.mp4   → camera (DB lookup by exact path)
     if len(parts) == 1:
@@ -240,8 +239,8 @@ def is_role_restricted(role: str, frigate_config: FrigateConfig) -> bool:
 
 
 def deny_response_for_media_uri(
-    original_url: Optional[str], role: Optional[str], frigate_config: FrigateConfig
-) -> Optional[int]:
+    original_url: str | None, role: str | None, frigate_config: FrigateConfig
+) -> int | None:
     """Decide whether the current role should be blocked from `original_url`.
 
     Returns an HTTP status code (403) when access should be denied, or `None`