Fix ruff, bandit and Pydantic-deprecation gate failures

Three issues surfaced by the project's own quality gates (all pass now):

- ruff PLC0415 in strix/report/pricing.py: the in-function `import litellm`
  is a deliberate lazy import (keeps the heavy dependency off the import
  path until a cost estimate is requested), exactly like its sibling
  report modules that are already listed in per-file-ignores. pricing.py
  was the only one missed — added it.

- bandit B105 in strix/config/codex.py: the OAuth authorize parameter
  `"id_token_add_organizations": "true"` is a boolean flag value, not a
  secret; the key name merely contains "token". Suppressed with
  `# nosec B105`, matching the existing B105 nosec on TOKEN_URL in the
  same file.

- Pydantic deprecation in strix/config/loader.py: `model_fields` accessed
  on an instance is deprecated (removed in Pydantic V3). Read it from the
  class via `type(s).model_fields`.

Verified: ruff, ruff-format, mypy, bandit all clean; 921 tests pass.

pyproject.toml

@@ -280,6 +280,9 @@ ignore = [
 # a runtime ``Callable`` annotation on ``vulnerability_found_callback``.
 "strix/report/state.py" = ["TC003", "PLR0912", "PLR0915", "E501", "PERF401", "PLC0415"]
 "strix/report/usage.py" = ["PLC0415"]
+# Lazy import of litellm keeps the heavy dependency off the import path until a
+# cost estimate is actually requested.
+"strix/report/pricing.py" = ["PLC0415"]
 # Lazy import of strix.config.models avoids a circular dependency between the
 # report pipeline and the config layer.
 "strix/report/dedupe.py" = ["PLC0415"]

strix/config/codex.py

@@ -183,7 +183,7 @@ def build_authorize_url(challenge: str, state: str) -> str:
         "code_challenge": challenge,
         "code_challenge_method": "S256",
         "state": state,
-        "id_token_add_organizations": "true",
+        "id_token_add_organizations": "true",  # nosec B105 - OAuth flag value, not a secret
         "codex_cli_simplified_flow": "true",
         "originator": ORIGINATOR,
     }

strix/config/loader.py

@@ -60,7 +60,7 @@ def persist_current() -> None:
     target.parent.mkdir(parents=True, exist_ok=True)
 
     env_block: dict[str, str] = {}
-    for sub_name in s.model_fields:
+    for sub_name in type(s).model_fields:
         sub_model = getattr(s, sub_name)
         if not isinstance(sub_model, BaseModel):
             continue