fix: resolve all CI lint and security issues

- ruff: 602→0 errors (428 auto-fixed, pyproject.toml ignores for FastAPI patterns)
- bandit: skip B310 (urllib for vault file access is intentional)
- Fixed SIM118 (dict.keys()→dict), PERF102, SIM113, SIM117
- Created pyproject.toml with ruff + bandit config
- 285 tests still pass

backend/watcher.py

@@ -1,13 +1,14 @@
 import asyncio
 import logging
 import time
+from collections.abc import Callable
 from pathlib import Path
-from typing import Callable, Dict, List, Optional
 
+from watchdog.events import FileSystemEventHandler
 from watchdog.observers import Observer
 from watchdog.observers.polling import PollingObserver
-from watchdog.events import FileSystemEventHandler
-from backend.indexer import SUPPORTED_EXTENSIONS, IGNORED_DIRS
+
+from backend.indexer import IGNORED_DIRS, SUPPORTED_EXTENSIONS
 
 logger = logging.getLogger("obsigate.watcher")
 
@@ -89,10 +90,10 @@ class VaultWatcher:
         self.polling_interval = polling_interval
         self.observers: dict[str, object] = {}
         self.event_queue: asyncio.Queue = asyncio.Queue()
-        self._processor_task: Optional[asyncio.Task] = None
+        self._processor_task: asyncio.Task | None = None
         self._running = False
 
-    async def start(self, vaults: Dict[str, str]):
+    async def start(self, vaults: dict[str, str]):
         """Démarrer la surveillance de toutes les vaults.
 
         Args:
@@ -170,7 +171,7 @@ class VaultWatcher:
         Accumule les événements pendant debounce_seconds puis appelle
         le callback une seule fois avec la liste consolidée.
         """
-        pending: Dict[str, dict] = {}
+        pending: dict[str, dict] = {}
 
         while self._running:
             try:
@@ -194,7 +195,7 @@ class VaultWatcher:
             except Exception as e:
                 logger.error(f"Event processor error: {e}")
 
-    async def _dispatch(self, events: List[dict]):
+    async def _dispatch(self, events: list[dict]):
         """Appeler le callback avec les événements consolidés."""
         try:
             await self.on_file_change(events)