[fastapi] Fix false positive for pre-assigned Depends variables (FAST003)

[kpeis695]

Summary

Fixes #17226.

When a Depends(...) call is pre-assigned to a variable and that variable is used as metadata in an Annotated annotation, FAST003 incorrectly fires:

async def find_item(item_id: int): ...

FindItem = Depends(find_item)

@app.get("/items/{item_id}")
async def get_item(item: Annotated[str, FindItem]): ...
#                                       ^^^^^^^^^
# FAST003: Parameter `item_id` appears in route path, but not in `get_item` signature

The rule scans Annotated metadata elements for literal Depends(...) calls. A pre-assigned Depends variable is a bare name — not a call expression — so depends_arguments returns None, the element is silently skipped by the filter_map, and the path parameter appears unused.

The fix treats a bare-name metadata element as Dependency::Unknown (unless it clearly resolves to a function, class, or import), which causes the check to abort conservatively rather than emitting a false positive.

Test Plan

Snapshot tests (cargo nextest run and cargo insta test).

[MichaReiser]

Can you rephrase the title please? I'm not sure what's up with installing fastapi

[kpeis695]

Updated the title — sorry about that, the FastAPI CLI in my shell polluted the output when I created the PR.

[ntBre]

If we're going to the trouble of resolving a Name to a binding, I don't think it would take much more to get the value itself and see if it's a Depends. Is that right?

[kpeis695]

Good point. If the binding is an Assignment, we could walk the RHS and look for a Depends(...) call. Would you want us to fully resolve what it wraps in that case, or just confirm it's a Depends and suppress if we can't trace it further? Happy to give it a shot either way.

[ntBre]

I think we should treat it the same way as an inline Depends.

[kpeis695]

Done. When the binding is an Assignment, we now walk the RHS and call depends_arguments on it. If it's a Depends call we treat it exactly like an inline one. If the RHS isn't a Depends at all we still fall back to Unknown to stay conservative.