Review SonarQube findings and security hotspots for the 0.3 stack

[Claudio9701]

The mandatory EL-BID SonarQube gate is enforced and correctly failing. PR #98 raised new-code coverage from 75.0% to 86.9% (threshold 80%) and duplication is 0%. Remaining project-level conditions are 13 new violations and 0% of new security hotspots reviewed (required 100%). An authorized EL-BID SonarQube maintainer must inspect the private dashboard, remediate valid findings in the relevant stacked PR, and review each hotspot with evidence. Do not weaken the gate, exclude source, or mark hotspots safe without analysis.

[Claudio9701]

Diagnostic evidence from the mandatory scan: SonarQube Community Build 26.3 exposes project-level (not pull-request-specific) quality-gate status. On PR #98 the conditions were new_coverage=86.9% (OK, threshold 80), new_duplicated_lines_density=0.0% (OK, threshold 3), new_security_hotspots_reviewed=0.0% (ERROR, required 100), and new_violations=13 (ERROR, required 0). Review the final stacked head (#106) in the Sonar dashboard, apply code fixes to the relevant PR(s), review hotspots with evidence, and rerun #106. Because analyses share project key EL-BID_urbanpy, avoid treating an older stacked PR dashboard snapshot as the final disposition.