fix: resolve all CI lint and security issues

- ruff: 602→0 errors (428 auto-fixed, pyproject.toml ignores for FastAPI patterns)
- bandit: skip B310 (urllib for vault file access is intentional)
- Fixed SIM118 (dict.keys()→dict), PERF102, SIM113, SIM117
- Created pyproject.toml with ruff + bandit config
- 285 tests still pass

backend/ratelimit.py

@@ -10,11 +10,10 @@ Configuration via environment variables:
     OBSIGATE_LOGIN_WINDOW_SECONDS Lockout window in seconds (default: 900 = 15min)
 """
 
+import logging
 import os
 import time
-import logging
 from collections import defaultdict
-from typing import Dict, Tuple
 
 logger = logging.getLogger("obsigate.ratelimit")
 
@@ -23,7 +22,7 @@ MAX_ATTEMPTS = int(os.environ.get("OBSIGATE_LOGIN_MAX_ATTEMPTS", "10"))
 WINDOW_SECONDS = int(os.environ.get("OBSIGATE_LOGIN_WINDOW_SECONDS", "900"))  # 15 min
 
 # --- In-memory store: {ip: [(timestamp, success_bool), ...]} ---
-_ip_attempts: Dict[str, list] = defaultdict(list)
+_ip_attempts: dict[str, list] = defaultdict(list)
 _last_cleanup = time.time()
 CLEANUP_INTERVAL = 60  # seconds
 
@@ -45,7 +44,7 @@ def _cleanup_expired():
         del _ip_attempts[ip]
 
 
-def record_failure(ip: str) -> Tuple[int, int]:
+def record_failure(ip: str) -> tuple[int, int]:
     """Record a failed login attempt from an IP.
 
     Returns: