Enable mypy in CI

[GeigerJ2]

Follow-up to #789. Foundational for the other typing follow-ups.

mypy excludes src/ (.pre-commit-config.yaml exclude ends with src/.*), so the package's annotations — including #789's Enums, Literal, and assert_never — are never checked. Improving types without a checker means they drift; enable it now, lenient and ratcheting (not big-bang strict).

• Drop src/.* from the mypy exclude.
• Add a [tool.mypy] section (none today): ignore_missing_imports = True (aiida/node_graph/plumpy ship no stubs), no global strict flags.
• Baseline the existing noise so only clean/touched files must pass: [[tool.mypy.overrides]] with ignore_errors = true on the messy modules.
• Tighten module-by-module, dropping each override as the module is cleaned; start with enums.py and the engine managers.