ruff (#169)

* polish: streamline nav, extract inline styles, improve tablet UX

- Restructure desktop nav from 8+ flat links + overflow dropdown into
  5 grouped dropdowns (Core, Agents, Intel, System, More) matching
  the mobile menu structure to reduce decision fatigue
- Extract all inline styles from mission_control.html and base.html
  notification elements into mission-control.css with semantic classes
- Replace JS-built innerHTML with secure DOM construction in
  notification loader and chat history
- Add CONNECTING state to connection indicator (amber) instead of
  showing OFFLINE before WebSocket connects
- Add tablet breakpoint (1024px) with larger touch targets for
  Apple Pencil / stylus use and safe-area padding for iPad toolbar
- Add active-link highlighting in desktop dropdown menus
- Rename "Mission Control" page title to "System Overview" to
  disambiguate from the chat home page
- Add "Home — Timmy Time" page title to index.html

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* fix(security): move auth-gate credentials to environment variables

Hardcoded username, password, and HMAC secret in auth-gate.py replaced
with os.environ lookups. Startup now refuses to run if any variable is
unset. Added AUTH_GATE_SECRET/USER/PASS to .env.example.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* refactor(tooling): migrate from black+isort+bandit to ruff

Replace three separate linting/formatting tools with a single ruff
invocation. Updates tox.ini (lint, format, pre-push, pre-commit envs),
.pre-commit-config.yaml, and CI workflow. Fixes all ruff errors
including unused imports, missing raise-from, and undefined names.
Ruff config maps existing bandit skips to equivalent S-rules.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

---------

Co-authored-by: Claude <noreply@anthropic.com>

src/dashboard/routes/calm.py

@@ -1,13 +1,12 @@
 import logging
 from datetime import date, datetime
-from typing import List, Optional
 
 from fastapi import APIRouter, Depends, Form, HTTPException, Request
 from fastapi.responses import HTMLResponse
 from sqlalchemy.orm import Session
 
 from dashboard.models.calm import JournalEntry, Task, TaskCertainty, TaskState
-from dashboard.models.database import SessionLocal, create_tables, engine, get_db
+from dashboard.models.database import create_tables, get_db
 from dashboard.templating import templates
 
 # Ensure CALM tables exist (safe to call multiple times)
@@ -19,15 +18,15 @@ router = APIRouter(tags=["calm"])
 
 
 # Helper functions for state machine logic
-def get_now_task(db: Session) -> Optional[Task]:
+def get_now_task(db: Session) -> Task | None:
     return db.query(Task).filter(Task.state == TaskState.NOW).first()
 
 
-def get_next_task(db: Session) -> Optional[Task]:
+def get_next_task(db: Session) -> Task | None:
     return db.query(Task).filter(Task.state == TaskState.NEXT).first()
 
 
-def get_later_tasks(db: Session) -> List[Task]:
+def get_later_tasks(db: Session) -> list[Task]:
     return (
         db.query(Task)
         .filter(Task.state == TaskState.LATER)
@@ -220,7 +219,7 @@ async def create_new_task(
     request: Request,
     db: Session = Depends(get_db),
     title: str = Form(...),
-    description: Optional[str] = Form(None),
+    description: str | None = Form(None),
     is_mit: bool = Form(False),
     certainty: TaskCertainty = Form(TaskCertainty.SOFT),
 ):
@@ -347,7 +346,7 @@ async def reorder_tasks(
     db: Session = Depends(get_db),
     # Expecting a comma-separated string of task IDs in new order
     later_task_ids: str = Form(""),
-    next_task_id: Optional[int] = Form(None),
+    next_task_id: int | None = Form(None),
 ):
     # Reorder LATER tasks
     if later_task_ids: