ruff (#169)

* polish: streamline nav, extract inline styles, improve tablet UX

- Restructure desktop nav from 8+ flat links + overflow dropdown into
  5 grouped dropdowns (Core, Agents, Intel, System, More) matching
  the mobile menu structure to reduce decision fatigue
- Extract all inline styles from mission_control.html and base.html
  notification elements into mission-control.css with semantic classes
- Replace JS-built innerHTML with secure DOM construction in
  notification loader and chat history
- Add CONNECTING state to connection indicator (amber) instead of
  showing OFFLINE before WebSocket connects
- Add tablet breakpoint (1024px) with larger touch targets for
  Apple Pencil / stylus use and safe-area padding for iPad toolbar
- Add active-link highlighting in desktop dropdown menus
- Rename "Mission Control" page title to "System Overview" to
  disambiguate from the chat home page
- Add "Home — Timmy Time" page title to index.html

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* fix(security): move auth-gate credentials to environment variables

Hardcoded username, password, and HMAC secret in auth-gate.py replaced
with os.environ lookups. Startup now refuses to run if any variable is
unset. Added AUTH_GATE_SECRET/USER/PASS to .env.example.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* refactor(tooling): migrate from black+isort+bandit to ruff

Replace three separate linting/formatting tools with a single ruff
invocation. Updates tox.ini (lint, format, pre-push, pre-commit envs),
.pre-commit-config.yaml, and CI workflow. Fixes all ruff errors
including unused imports, missing raise-from, and undefined names.
Ruff config maps existing bandit skips to equivalent S-rules.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

---------

Co-authored-by: Claude <noreply@anthropic.com>

src/brain/client.py

@@ -10,7 +10,7 @@ import logging
 import os
 import socket
 from datetime import datetime
-from typing import Any, Dict, List, Optional
+from typing import Any
 
 import httpx
 
@@ -26,7 +26,7 @@ class BrainClient:
     All writes go to leader, reads can come from local node.
     """
 
-    def __init__(self, rqlite_url: Optional[str] = None, node_id: Optional[str] = None):
+    def __init__(self, rqlite_url: str | None = None, node_id: str | None = None):
         from config import settings
 
         self.rqlite_url = rqlite_url or settings.rqlite_url or DEFAULT_RQLITE_URL
@@ -49,10 +49,10 @@ class BrainClient:
     async def remember(
         self,
         content: str,
-        tags: Optional[List[str]] = None,
-        source: Optional[str] = None,
-        metadata: Optional[Dict[str, Any]] = None,
-    ) -> Dict[str, Any]:
+        tags: list[str] | None = None,
+        source: str | None = None,
+        metadata: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
         """Store a memory with embedding.
 
         Args:
@@ -100,8 +100,8 @@ class BrainClient:
             raise
 
     async def recall(
-        self, query: str, limit: int = 5, sources: Optional[List[str]] = None
-    ) -> List[str]:
+        self, query: str, limit: int = 5, sources: list[str] | None = None
+    ) -> list[str]:
         """Semantic search for memories.
 
         Args:
@@ -154,8 +154,8 @@ class BrainClient:
             return []
 
     async def get_recent(
-        self, hours: int = 24, limit: int = 20, sources: Optional[List[str]] = None
-    ) -> List[Dict[str, Any]]:
+        self, hours: int = 24, limit: int = 20, sources: list[str] | None = None
+    ) -> list[dict[str, Any]]:
         """Get recent memories by time.
 
         Args:
@@ -239,8 +239,8 @@ class BrainClient:
         content: str,
         task_type: str = "general",
         priority: int = 0,
-        metadata: Optional[Dict[str, Any]] = None,
-    ) -> Dict[str, Any]:
+        metadata: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
         """Submit a task to the distributed queue.
 
         Args:
@@ -281,8 +281,8 @@ class BrainClient:
             raise
 
     async def claim_task(
-        self, capabilities: List[str], node_id: Optional[str] = None
-    ) -> Optional[Dict[str, Any]]:
+        self, capabilities: list[str], node_id: str | None = None
+    ) -> dict[str, Any] | None:
         """Atomically claim next available task.
 
         Uses UPDATE ... RETURNING pattern for atomic claim.
@@ -341,7 +341,7 @@ class BrainClient:
             return None
 
     async def complete_task(
-        self, task_id: int, success: bool, result: Optional[str] = None, error: Optional[str] = None
+        self, task_id: int, success: bool, result: str | None = None, error: str | None = None
     ) -> None:
         """Mark task as completed or failed.
 
@@ -370,7 +370,7 @@ class BrainClient:
         except Exception as e:
             logger.error(f"Failed to complete task {task_id}: {e}")
 
-    async def get_pending_tasks(self, limit: int = 100) -> List[Dict[str, Any]]:
+    async def get_pending_tasks(self, limit: int = 100) -> list[dict[str, Any]]:
         """Get list of pending tasks (for dashboard/monitoring).
 
         Args: