ruff (#169)

* polish: streamline nav, extract inline styles, improve tablet UX

- Restructure desktop nav from 8+ flat links + overflow dropdown into
  5 grouped dropdowns (Core, Agents, Intel, System, More) matching
  the mobile menu structure to reduce decision fatigue
- Extract all inline styles from mission_control.html and base.html
  notification elements into mission-control.css with semantic classes
- Replace JS-built innerHTML with secure DOM construction in
  notification loader and chat history
- Add CONNECTING state to connection indicator (amber) instead of
  showing OFFLINE before WebSocket connects
- Add tablet breakpoint (1024px) with larger touch targets for
  Apple Pencil / stylus use and safe-area padding for iPad toolbar
- Add active-link highlighting in desktop dropdown menus
- Rename "Mission Control" page title to "System Overview" to
  disambiguate from the chat home page
- Add "Home — Timmy Time" page title to index.html

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* fix(security): move auth-gate credentials to environment variables

Hardcoded username, password, and HMAC secret in auth-gate.py replaced
with os.environ lookups. Startup now refuses to run if any variable is
unset. Added AUTH_GATE_SECRET/USER/PASS to .env.example.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* refactor(tooling): migrate from black+isort+bandit to ruff

Replace three separate linting/formatting tools with a single ruff
invocation. Updates tox.ini (lint, format, pre-push, pre-commit envs),
.pre-commit-config.yaml, and CI workflow. Fixes all ruff errors
including unused imports, missing raise-from, and undefined names.
Ruff config maps existing bandit skips to equivalent S-rules.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

---------

Co-authored-by: Claude <noreply@anthropic.com>

src/brain/worker.py

@@ -11,8 +11,8 @@ import logging
 import os
 import socket
 import subprocess
-from datetime import datetime
-from typing import Any, Callable, Dict, List, Optional
+from collections.abc import Callable
+from typing import Any
 
 from brain.client import BrainClient
 
@@ -26,15 +26,15 @@ class DistributedWorker:
     executes them immediately, stores results.
     """
 
-    def __init__(self, brain_client: Optional[BrainClient] = None):
+    def __init__(self, brain_client: BrainClient | None = None):
         self.brain = brain_client or BrainClient()
         self.node_id = f"{socket.gethostname()}-{os.getpid()}"
         self.capabilities = self._detect_capabilities()
         self.running = False
-        self._handlers: Dict[str, Callable] = {}
+        self._handlers: dict[str, Callable] = {}
         self._register_default_handlers()
 
-    def _detect_capabilities(self) -> List[str]:
+    def _detect_capabilities(self) -> list[str]:
         """Detect what this node can do."""
         caps = ["general", "shell", "file_ops", "git"]
 
@@ -260,13 +260,13 @@ class DistributedWorker:
             return result
 
         except Exception as e:
-            raise Exception(f"LLM failed: {e}")
+            raise Exception(f"LLM failed: {e}") from e
 
     # ──────────────────────────────────────────────────────────────────────────
     # Main Loop
     # ──────────────────────────────────────────────────────────────────────────
 
-    async def execute_task(self, task: Dict[str, Any]) -> Dict[str, Any]:
+    async def execute_task(self, task: dict[str, Any]) -> dict[str, Any]:
         """Execute a claimed task."""
         task_type = task.get("type", "general")
         content = task.get("content", "")