ruff (#169)

* polish: streamline nav, extract inline styles, improve tablet UX

- Restructure desktop nav from 8+ flat links + overflow dropdown into
  5 grouped dropdowns (Core, Agents, Intel, System, More) matching
  the mobile menu structure to reduce decision fatigue
- Extract all inline styles from mission_control.html and base.html
  notification elements into mission-control.css with semantic classes
- Replace JS-built innerHTML with secure DOM construction in
  notification loader and chat history
- Add CONNECTING state to connection indicator (amber) instead of
  showing OFFLINE before WebSocket connects
- Add tablet breakpoint (1024px) with larger touch targets for
  Apple Pencil / stylus use and safe-area padding for iPad toolbar
- Add active-link highlighting in desktop dropdown menus
- Rename "Mission Control" page title to "System Overview" to
  disambiguate from the chat home page
- Add "Home — Timmy Time" page title to index.html

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* fix(security): move auth-gate credentials to environment variables

Hardcoded username, password, and HMAC secret in auth-gate.py replaced
with os.environ lookups. Startup now refuses to run if any variable is
unset. Added AUTH_GATE_SECRET/USER/PASS to .env.example.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* refactor(tooling): migrate from black+isort+bandit to ruff

Replace three separate linting/formatting tools with a single ruff
invocation. Updates tox.ini (lint, format, pre-push, pre-commit envs),
.pre-commit-config.yaml, and CI workflow. Fixes all ruff errors
including unused imports, missing raise-from, and undefined names.
Ruff config maps existing bandit skips to equivalent S-rules.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

---------

Co-authored-by: Claude <noreply@anthropic.com>

Makefile

@@ -1,4 +1,4 @@
-.PHONY: install install-bigbrain install-hooks dev nuke fresh test test-cov test-cov-html watch lint clean help \
+.PHONY: bootstrap install install-bigbrain install-hooks dev nuke fresh test test-cov test-cov-html watch lint clean help \
         up down logs \
         docker-build docker-up docker-down docker-agent docker-logs docker-shell \
         test-docker test-docker-cov test-docker-functional test-docker-build test-docker-down \
@@ -9,6 +9,16 @@ TOX         := tox
 
 # ── Setup ─────────────────────────────────────────────────────────────────────
 
+bootstrap:
+	@echo "  Bootstrapping Timmy Time development environment..."
+	@python3 -c "import sys; exit(0 if sys.version_info >= (3,11) else 1)" \
+	    || { echo "ERROR: Python 3.11+ required (found $$(python3 --version))"; exit 1; }
+	poetry install --with dev
+	@[ -f .env ] || { cp .env.example .env; echo "  Created .env from .env.example — edit as needed"; }
+	git config core.hooksPath .githooks
+	@command -v pre-commit >/dev/null 2>&1 && pre-commit install || true
+	@echo "  Ready. Run 'make dev' to start the dashboard."
+
 install:
 	poetry install --with dev
 	git config core.hooksPath .githooks
@@ -297,6 +307,7 @@ help:
 	@echo ""
 	@echo "  Local Development"
 	@echo "  ─────────────────────────────────────────────────"
+	@echo "  make bootstrap        one-command setup for new developers"
 	@echo "  make install          install deps via Poetry"
 	@echo "  make install-bigbrain install with AirLLM (big-model backend)"
 	@echo "  make dev              clean up + start dashboard (auto-fixes errno 48)"
@@ -307,8 +318,8 @@ help:
 	@echo "  make test-cov         tests + coverage report (terminal + XML)"
 	@echo "  make test-cov-html    tests + HTML coverage report"
 	@echo "  make watch            self-TDD watchdog (60s poll)"
-	@echo "  make lint             run ruff or flake8"
-	@echo "  make format           format code (black, isort)"
+	@echo "  make lint             check formatting + imports + security (ruff)"
+	@echo "  make format           auto-format code (ruff)"
 	@echo "  make type-check       run type checking (mypy)"
 	@echo "  make pre-commit-run   run all pre-commit checks"
 	@echo "  make test-unit        run unit tests only"