fix: what bandit and the remaining lint rules found

- Long docstring and command lines are wrapped; recorded device output in
  tests/ keeps its lines (E501 is off there).
- host_firewall: the negation token is the named constant _NEGATION. bandit
  read token == "!" as a hardcoded password.
- ssh_host_keys: _known_hosts_file takes the expected key as an argument
  instead of asserting it; both callers had already returned when it is None.
- ssh_server: the staged path is on the device, not a local temp file
  (nosec B108).
- tests: raise ... from exc, zip(strict=True).

pyproject.toml

@@ -71,6 +71,10 @@ target-version = "py310"
 [tool.ruff.lint]
 select = ["E", "F", "I", "UP", "B"]
 
+[tool.ruff.lint.per-file-ignores]
+# Recorded device output keeps its lines.
+"tests/**" = ["E501"]
+
 [tool.mypy]
 python_version = "3.10"
 strict = true