SIENTIAPDE-1646

Simplify bandit nosec comments and mock metrics_controller with real spe

- drift.py/simple_metrics.py: move nosec rationale to a code comment above
  the query instead of an inline suppression comment, keeping bandit happy
  with a plain `# nosec`
- tests: replace bare `MagicMock()` with `MagicMock(spec=MetricsController)`
  for metrics_controller across activities/repository tests so mocks fail
  fast on attribute typos instead of silently accepting any call

tests/laborious/activities/test_opc.py

@@ -4,6 +4,7 @@ import pytest
 from pandas import DataFrame
 from pytest import mark
 from sientia_do.notifications.models import NotificationLevel
+from sientia_do.observability.metrics_controller import MetricsController
 
 from laborious.activities.opc import (
     OPC,
@@ -32,7 +33,7 @@ def test__init__():
         opc_servers=servers,
         logger=MagicMock(),
         notification_handler=MagicMock(),
-        metrics_controller=MagicMock(),
+        metrics_controller=MagicMock(spec=MetricsController),
     )
 
     assert opc.opc_servers == servers
@@ -43,7 +44,7 @@ def test__init__():
 @patch('laborious.activities.opc.OPC.send_notification')
 def test_init_opc(mock_send_notification, mock_opc_repository):
     mock_logger = MagicMock()
-    mock_metrics_controller = MagicMock()
+    mock_metrics_controller = MagicMock(spec=MetricsController)
     server1 = MagicMock(
         connect=MagicMock(return_value=(True, {})), write_data=MagicMock(return_value=(True, {}))
     )
@@ -192,7 +193,7 @@ def opc(mock_opc_repository):
         opc_servers=servers,
         logger=MagicMock(),
         notification_handler=MagicMock(),
-        metrics_controller=MagicMock(),
+        metrics_controller=MagicMock(spec=MetricsController),
     )
     opc.init_opc()
     opc.send_notification = MagicMock()