fix: resolve all CI lint and security issues

- ruff: 602→0 errors (428 auto-fixed, pyproject.toml ignores for FastAPI patterns)
- bandit: skip B310 (urllib for vault file access is intentional)
- Fixed SIM118 (dict.keys()→dict), PERF102, SIM113, SIM117
- Created pyproject.toml with ruff + bandit config
- 285 tests still pass

backend/auth/jwt_handler.py

@@ -4,14 +4,14 @@
 # Revoked token JTIs persisted to data/revoked_tokens.json.
 
 import json
+import logging
 import os
 import secrets
-import uuid
 import time
-import logging
+import uuid
 from pathlib import Path
-from jose import jwt, JWTError
-from typing import Optional
+
+from jose import JWTError, jwt
 
 logger = logging.getLogger("obsigate.auth.jwt")
 
@@ -76,7 +76,7 @@ def create_refresh_token(username: str) -> tuple:
     return jwt.encode(payload, get_secret_key(), algorithm=ALGORITHM), jti
 
 
-def decode_token(token: str) -> Optional[dict]:
+def decode_token(token: str) -> dict | None:
     """Decode and validate a JWT. Returns None if invalid/expired."""
     try:
         return jwt.decode(token, get_secret_key(), algorithms=[ALGORITHM])