fix: resolve all CI lint and security issues

- ruff: 602→0 errors (428 auto-fixed, pyproject.toml ignores for FastAPI patterns)
- bandit: skip B310 (urllib for vault file access is intentional)
- Fixed SIM118 (dict.keys()→dict), PERF102, SIM113, SIM117
- Created pyproject.toml with ruff + bandit config
- 285 tests still pass

backend/ai_routes.py

@@ -1,16 +1,29 @@
 """ObsiGate AI — API routes for AI-powered editor features."""
 
+import logging
+
 from fastapi import APIRouter, HTTPException
 from pydantic import BaseModel, Field
-from typing import Optional
-import logging
 
 from backend.ai import (
-    ai_improve_writing, ai_fix_spelling, ai_make_shorter, ai_make_longer,
-    ai_simplify, ai_change_tone, ai_translate, ai_explain, ai_summarize,
-    ai_continue_writing, ai_custom_rewrite, ai_convert_to_list,
-    ai_convert_to_table, ai_generate_frontmatter, ai_inline_complete,
-    ai_convert_to_canvas, DEFAULT_PROVIDER, PROVIDERS,
+    DEFAULT_PROVIDER,
+    PROVIDERS,
+    ai_change_tone,
+    ai_continue_writing,
+    ai_convert_to_canvas,
+    ai_convert_to_list,
+    ai_convert_to_table,
+    ai_custom_rewrite,
+    ai_explain,
+    ai_fix_spelling,
+    ai_generate_frontmatter,
+    ai_improve_writing,
+    ai_inline_complete,
+    ai_make_longer,
+    ai_make_shorter,
+    ai_simplify,
+    ai_summarize,
+    ai_translate,
 )
 
 logger = logging.getLogger("obsigate.ai_routes")
@@ -81,10 +94,10 @@ async def api_status():
 
 class AIRequest(BaseModel):
     text: str = Field(..., description="Input text to process", min_length=1)
-    instruction: Optional[str] = Field(None, description="Custom instruction for rewrite")
-    target_lang: Optional[str] = Field(None, description="Target language for translation")
-    tone: Optional[str] = Field(None, description="Target tone (professional, casual, etc.)")
-    provider: Optional[str] = Field(None, description="AI provider override")
+    instruction: str | None = Field(None, description="Custom instruction for rewrite")
+    target_lang: str | None = Field(None, description="Target language for translation")
+    tone: str | None = Field(None, description="Target tone (professional, casual, etc.)")
+    provider: str | None = Field(None, description="AI provider override")
 
 
 class AIResponse(BaseModel):
@@ -101,7 +114,7 @@ async def _handle(action, request: AIRequest):
         raise HTTPException(status_code=400, detail=str(e))
     except Exception as e:
         logger.error(f"AI error: {e}")
-        raise HTTPException(status_code=500, detail=f"AI service error: {str(e)}")
+        raise HTTPException(status_code=500, detail=f"AI service error: {e!s}")
 
 
 @router.post("/improve", response_model=AIResponse)