fix: resolve all CI lint and security issues

- ruff: 602→0 errors (428 auto-fixed, pyproject.toml ignores for FastAPI patterns)
- bandit: skip B310 (urllib for vault file access is intentional)
- Fixed SIM118 (dict.keys()→dict), PERF102, SIM113, SIM117
- Created pyproject.toml with ruff + bandit config
- 285 tests still pass

backend/auth/router.py

@@ -2,24 +2,37 @@
 # All /api/auth/* endpoints: login, logout, refresh, me, change-password,
 # and admin user CRUD.
 
-import re
 import logging
-from fastapi import APIRouter, HTTPException, Response, Request, Depends
+import re
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from pydantic import BaseModel, validator
-from typing import List, Optional
+
+from backend.ratelimit import is_rate_limited
+from backend.ratelimit import record_failure as rl_record_failure
+from backend.ratelimit import record_success as rl_record_success
 
-from .user_store import (
-    get_user, get_all_users, create_user, update_user, delete_user,
-    record_login_success, record_login_failure, is_locked, has_users,
-)
 from .jwt_handler import (
-    create_access_token, create_refresh_token, decode_token,
-    revoke_token, is_token_revoked,
     ACCESS_TOKEN_EXPIRE_SECONDS,
+    create_access_token,
+    create_refresh_token,
+    decode_token,
+    is_token_revoked,
+    revoke_token,
+)
+from .middleware import is_auth_enabled, require_admin, require_auth
+from .password import hash_password, verify_password
+from .user_store import (
+    create_user,
+    delete_user,
+    get_all_users,
+    get_user,
+    has_users,
+    is_locked,
+    record_login_failure,
+    record_login_success,
+    update_user,
 )
-from .middleware import require_auth, require_admin, is_auth_enabled
-from .password import verify_password, hash_password
-from backend.ratelimit import is_rate_limited, record_failure as rl_record_failure, record_success as rl_record_success
 
 logger = logging.getLogger("obsigate.auth.router")
 
@@ -48,9 +61,9 @@ class ChangePasswordRequest(BaseModel):
 class CreateUserRequest(BaseModel):
     username: str
     password: str
-    display_name: Optional[str] = None
+    display_name: str | None = None
     role: str = "user"
-    vaults: List[str] = []
+    vaults: list[str] = []
 
     @validator("username")
     def username_valid(cls, v):
@@ -66,11 +79,11 @@ class CreateUserRequest(BaseModel):
 
 
 class UpdateUserRequest(BaseModel):
-    display_name: Optional[str] = None
-    vaults: Optional[List[str]] = None
-    active: Optional[bool] = None
-    password: Optional[str] = None
-    role: Optional[str] = None
+    display_name: str | None = None
+    vaults: list[str] | None = None
+    active: bool | None = None
+    password: str | None = None
+    role: str | None = None
 
 
 # ── Public endpoints ──────────────────────────────────────────────────
@@ -249,8 +262,8 @@ async def get_me(current_user=Depends(require_auth)):
 
 class UpdateMeRequest(BaseModel):
     """Fields the user can update on their own profile."""
-    display_name: Optional[str] = None
-    language: Optional[str] = None
+    display_name: str | None = None
+    language: str | None = None
 
 
 @router.patch("/me")