fix: resolve all CI lint and security issues

- ruff: 602→0 errors (428 auto-fixed, pyproject.toml ignores for FastAPI patterns)
- bandit: skip B310 (urllib for vault file access is intentional)
- Fixed SIM118 (dict.keys()→dict), PERF102, SIM113, SIM117
- Created pyproject.toml with ruff + bandit config
- 285 tests still pass

backend/webhooks.py

@@ -8,19 +8,17 @@ Events: file_created, file_deleted, file_modified, file_renamed,
         directory_created, directory_deleted, directory_renamed
 """
 
-import json
-import hmac
-import hashlib
 import asyncio
+import hashlib
+import hmac
+import json
 import logging
 import uuid
-from pathlib import Path
 from datetime import datetime, timezone
-from typing import Optional, List
+from pathlib import Path
 
 import aiohttp
 
-
 logger = logging.getLogger("obsigate.webhooks")
 
 WEBHOOKS_FILE = Path("data/webhooks.json")
@@ -51,7 +49,7 @@ def get_webhooks() -> list:
     return _read()
 
 
-def create_webhook(name: str, url: str, events: List[str], secret: Optional[str] = None) -> dict:
+def create_webhook(name: str, url: str, events: list[str], secret: str | None = None) -> dict:
     webhooks = _read()
     wh = {
         "id": str(uuid.uuid4()),
@@ -69,7 +67,7 @@ def create_webhook(name: str, url: str, events: List[str], secret: Optional[str]
     return wh
 
 
-def update_webhook(wh_id: str, updates: dict) -> Optional[dict]:
+def update_webhook(wh_id: str, updates: dict) -> dict | None:
     webhooks = _read()
     for wh in webhooks:
         if wh["id"] == wh_id:
@@ -110,8 +108,7 @@ async def dispatch_webhooks(event_type: str, data: dict):
                 headers["X-ObsiGate-Signature"] = f"sha256={sig}"
 
             timeout = aiohttp.ClientTimeout(total=5)
-            async with aiohttp.ClientSession(timeout=timeout) as session:
-                async with session.post(wh["url"], data=body, headers=headers) as resp:
+            async with aiohttp.ClientSession(timeout=timeout) as session, session.post(wh["url"], data=body, headers=headers) as resp:
                     if resp.status < 400:
                         logger.debug(f"Webhook '{wh['name']}' OK ({resp.status})")
                     else: