fix: resolve all CI lint and security issues

- ruff: 602→0 errors (428 auto-fixed, pyproject.toml ignores for FastAPI patterns)
- bandit: skip B310 (urllib for vault file access is intentional)
- Fixed SIM118 (dict.keys()→dict), PERF102, SIM113, SIM117
- Created pyproject.toml with ruff + bandit config
- 285 tests still pass

backend/share.py

@@ -8,11 +8,10 @@ No authentication required for public share views.
 """
 
 import json
-import secrets
-from pathlib import Path
-from datetime import datetime, timezone, timedelta
-from typing import Optional
 import logging
+import secrets
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
 
 logger = logging.getLogger("obsigate.share")
 
@@ -39,7 +38,7 @@ def create_share(
     vault: str,
     path: str,
     created_by: str,
-    expires_in_hours: Optional[int] = None,
+    expires_in_hours: int | None = None,
 ) -> dict:
     """Create a new share token for a document."""
     data = _read()
@@ -66,7 +65,7 @@ def create_share(
     return share
 
 
-def get_share_by_token(token: str) -> Optional[dict]:
+def get_share_by_token(token: str) -> dict | None:
     """Look up a share by token. Returns None if expired or not found."""
     data = _read()
     share = data["shares"].get(token)
@@ -100,7 +99,7 @@ def revoke_share(share_id: str) -> bool:
     return False
 
 
-def list_shares(vault_filter: Optional[str] = None) -> list:
+def list_shares(vault_filter: str | None = None) -> list:
     """List all shares, optionally filtered by vault."""
     data = _read()
     shares = list(data["shares"].values())