ruff (#169)

* polish: streamline nav, extract inline styles, improve tablet UX

- Restructure desktop nav from 8+ flat links + overflow dropdown into
  5 grouped dropdowns (Core, Agents, Intel, System, More) matching
  the mobile menu structure to reduce decision fatigue
- Extract all inline styles from mission_control.html and base.html
  notification elements into mission-control.css with semantic classes
- Replace JS-built innerHTML with secure DOM construction in
  notification loader and chat history
- Add CONNECTING state to connection indicator (amber) instead of
  showing OFFLINE before WebSocket connects
- Add tablet breakpoint (1024px) with larger touch targets for
  Apple Pencil / stylus use and safe-area padding for iPad toolbar
- Add active-link highlighting in desktop dropdown menus
- Rename "Mission Control" page title to "System Overview" to
  disambiguate from the chat home page
- Add "Home — Timmy Time" page title to index.html

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* fix(security): move auth-gate credentials to environment variables

Hardcoded username, password, and HMAC secret in auth-gate.py replaced
with os.environ lookups. Startup now refuses to run if any variable is
unset. Added AUTH_GATE_SECRET/USER/PASS to .env.example.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* refactor(tooling): migrate from black+isort+bandit to ruff

Replace three separate linting/formatting tools with a single ruff
invocation. Updates tox.ini (lint, format, pre-push, pre-commit envs),
.pre-commit-config.yaml, and CI workflow. Fixes all ruff errors
including unused imports, missing raise-from, and undefined names.
Ruff config maps existing bandit skips to equivalent S-rules.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

---------

Co-authored-by: Claude <noreply@anthropic.com>

auth-gate.py

@@ -1,10 +1,10 @@
 #!/usr/bin/env python3
 """Tiny auth gate for nginx auth_request. Sets a cookie after successful basic auth."""
-import hashlib, hmac, http.server, time, base64, os
+import hashlib, hmac, http.server, time, base64, os, sys
 
-SECRET = "sovereign-timmy-gate-2026"
-USER = "Rockachopa"
-PASS = "Iamrockachopathegend"
+SECRET = os.environ.get("AUTH_GATE_SECRET", "")
+USER = os.environ.get("AUTH_GATE_USER", "")
+PASS = os.environ.get("AUTH_GATE_PASS", "")
 COOKIE_NAME = "sovereign_gate"
 COOKIE_MAX_AGE = 86400 * 7  # 7 days
 
@@ -63,6 +63,8 @@ class Handler(http.server.BaseHTTPRequestHandler):
         self.end_headers()
 
 if __name__ == "__main__":
+    if not all([SECRET, USER, PASS]):
+        sys.exit("ERROR: AUTH_GATE_SECRET, AUTH_GATE_USER, and AUTH_GATE_PASS must be set")
     s = http.server.HTTPServer(("127.0.0.1", 9876), Handler)
     print("Auth gate listening on 127.0.0.1:9876")
     s.serve_forever()