ruff (#169)

* polish: streamline nav, extract inline styles, improve tablet UX

- Restructure desktop nav from 8+ flat links + overflow dropdown into
  5 grouped dropdowns (Core, Agents, Intel, System, More) matching
  the mobile menu structure to reduce decision fatigue
- Extract all inline styles from mission_control.html and base.html
  notification elements into mission-control.css with semantic classes
- Replace JS-built innerHTML with secure DOM construction in
  notification loader and chat history
- Add CONNECTING state to connection indicator (amber) instead of
  showing OFFLINE before WebSocket connects
- Add tablet breakpoint (1024px) with larger touch targets for
  Apple Pencil / stylus use and safe-area padding for iPad toolbar
- Add active-link highlighting in desktop dropdown menus
- Rename "Mission Control" page title to "System Overview" to
  disambiguate from the chat home page
- Add "Home — Timmy Time" page title to index.html

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* fix(security): move auth-gate credentials to environment variables

Hardcoded username, password, and HMAC secret in auth-gate.py replaced
with os.environ lookups. Startup now refuses to run if any variable is
unset. Added AUTH_GATE_SECRET/USER/PASS to .env.example.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* refactor(tooling): migrate from black+isort+bandit to ruff

Replace three separate linting/formatting tools with a single ruff
invocation. Updates tox.ini (lint, format, pre-push, pre-commit envs),
.pre-commit-config.yaml, and CI workflow. Fixes all ruff errors
including unused imports, missing raise-from, and undefined names.
Ruff config maps existing bandit skips to equivalent S-rules.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

---------

Co-authored-by: Claude <noreply@anthropic.com>

pyproject.toml

@@ -24,17 +24,17 @@ packages = [
 
 [tool.poetry.dependencies]
 python = ">=3.11,<4"
-agno = { version = ">=1.4.0", extras = ["sqlite"] }
-ollama = ">=0.3.0"
+agno = { version = ">=1.4.0,<2.0", extras = ["sqlite"] }
+ollama = ">=0.3.0,<1.0"
 openai = ">=1.0.0"
-fastapi = ">=0.115.0"
-uvicorn = { version = ">=0.32.0", extras = ["standard"] }
+fastapi = ">=0.115.0,<1.0"
+uvicorn = { version = ">=0.32.0,<1.0", extras = ["standard"] }
 jinja2 = ">=3.1.0"
 httpx = ">=0.27.0"
 python-multipart = ">=0.0.12"
 typer = ">=0.12.0"
 rich = ">=13.0.0"
-pydantic-settings = ">=2.0.0"
+pydantic-settings = ">=2.0.0,<3.0"
 # Optional extras
 redis = { version = ">=5.0.0", optional = true }
 celery = { version = ">=5.3.0", extras = ["redis"], optional = true }
@@ -72,8 +72,7 @@ pytest-timeout = ">=2.3.0"
 selenium = ">=4.20.0"
 pytest-randomly = "^4.0.1"
 pytest-xdist = "^3.8.0"
-black = ">=24.0.0"
-isort = ">=5.13.0"
+ruff = ">=0.8.0"
 
 [tool.poetry.scripts]
 timmy = "timmy.cli:main"
@@ -102,11 +101,31 @@ markers = [
     "skip_ci: Skip in CI environment (local development only)",
 ]
 
-[tool.isort]
-profile = "black"
-line_length = 100
-src_paths = ["src", "tests"]
-known_first_party = ["brain", "config", "dashboard", "infrastructure", "integrations", "spark", "swarm", "timmy", "timmy_serve"]
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "S"]
+ignore = [
+    # Mapped from existing bandit skips: B101→S101, B104→S104, etc.
+    "S101", "S104", "S307", "S310", "S324", "S601", "S608",
+    # Project patterns: graceful degradation (try/except pass), FastAPI Depends()
+    "S110", "S112", "B008",
+    # Subprocess usage in scripts/infrastructure
+    "S603", "S607",
+    # Non-cryptographic random is fine for non-security contexts
+    "S311",
+    # Line length handled by formatter; long strings/URLs can't always be broken
+    "E501",
+]
+
+[tool.ruff.lint.isort]
+known-first-party = ["brain", "config", "dashboard", "infrastructure", "integrations", "spark", "swarm", "timmy", "timmy_serve"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["S"]
 
 [tool.coverage.run]
 source = ["src"]