fix: add missing APIRouter import and None-safety in instance_service

- Import APIRouter from fastapi (NameError on module load)
- Add None check after session.get(ToolType) to prevent AttributeError
- Type-annotate volume_mounts and guard extend() with isinstance(list)

Quality gates: py_compile pass, LSP clean

apps/api/src/services/tool/instance_service.py

@@ -7,9 +7,10 @@ import os
 import subprocess
 import uuid
 from datetime import datetime
+from typing import Any
 
 import httpx
-from fastapi import HTTPException, status
+from fastapi import APIRouter, HTTPException, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -97,12 +98,12 @@ async def resolve_git_mounts(
 
     results = await asyncio.gather(*tasks, return_exceptions=True)
 
-    volume_mounts = []
+    volume_mounts: list[dict[str, Any]] = []
     for result in results:
         if isinstance(result, Exception):
             logger.warning("Git mount failed: %s", result)
             continue
-        if result:
+        if isinstance(result, list):
             volume_mounts.extend(result)
 
     return volume_mounts
@@ -758,6 +759,9 @@ async def prepare_manifest_instance(
     from src.models import ToolDefinitionManifest
 
     tool_type = await session.get(ToolType, instance.tool_type_id)
+    if not tool_type:
+        raise RuntimeError(f"Tool type {instance.tool_type_id} not found")
+
     manifest_def = await session.get(ToolDefinitionManifest, tool_type.manifest_id)
 
     if not manifest_def: