fix: resolve all CI lint and security issues

- ruff: 602→0 errors (428 auto-fixed, pyproject.toml ignores for FastAPI patterns)
- bandit: skip B310 (urllib for vault file access is intentional)
- Fixed SIM118 (dict.keys()→dict), PERF102, SIM113, SIM117
- Created pyproject.toml with ruff + bandit config
- 285 tests still pass

backend/image_processor.py

@@ -1,8 +1,7 @@
-import re
 import logging
-from pathlib import Path
-from typing import Optional
+import re
 from html import escape as html_escape
+from pathlib import Path
 
 from backend.attachment_indexer import resolve_image_path
 
@@ -13,8 +12,8 @@ def preprocess_images(
     content: str,
     vault_name: str,
     vault_root: Path,
-    current_file_path: Optional[Path] = None,
-    attachments_path: Optional[str] = None
+    current_file_path: Path | None = None,
+    attachments_path: str | None = None
 ) -> str:
     """Preprocess markdown content to transform all Obsidian image syntaxes.
     
@@ -55,8 +54,8 @@ def _process_html_img_in_link(
     content: str,
     vault_name: str,
     vault_root: Path,
-    current_file_path: Optional[Path],
-    attachments_path: Optional[str]
+    current_file_path: Path | None,
+    attachments_path: str | None
 ) -> str:
     """Process [<img ... src="path"/>](url) syntax.
     
@@ -119,8 +118,8 @@ def _process_wikilink_embeds(
     content: str,
     vault_name: str,
     vault_root: Path,
-    current_file_path: Optional[Path],
-    attachments_path: Optional[str]
+    current_file_path: Path | None,
+    attachments_path: str | None
 ) -> str:
     """Process ![[image]] and ![[path/to/image]] wiki-link embeds.
     
@@ -158,8 +157,8 @@ def _process_standard_images(
     content: str,
     vault_name: str,
     vault_root: Path,
-    current_file_path: Optional[Path],
-    attachments_path: Optional[str]
+    current_file_path: Path | None,
+    attachments_path: str | None
 ) -> str:
     """Process ![alt](path) standard markdown images.