ruff (#169)

* polish: streamline nav, extract inline styles, improve tablet UX

- Restructure desktop nav from 8+ flat links + overflow dropdown into
  5 grouped dropdowns (Core, Agents, Intel, System, More) matching
  the mobile menu structure to reduce decision fatigue
- Extract all inline styles from mission_control.html and base.html
  notification elements into mission-control.css with semantic classes
- Replace JS-built innerHTML with secure DOM construction in
  notification loader and chat history
- Add CONNECTING state to connection indicator (amber) instead of
  showing OFFLINE before WebSocket connects
- Add tablet breakpoint (1024px) with larger touch targets for
  Apple Pencil / stylus use and safe-area padding for iPad toolbar
- Add active-link highlighting in desktop dropdown menus
- Rename "Mission Control" page title to "System Overview" to
  disambiguate from the chat home page
- Add "Home — Timmy Time" page title to index.html

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* fix(security): move auth-gate credentials to environment variables

Hardcoded username, password, and HMAC secret in auth-gate.py replaced
with os.environ lookups. Startup now refuses to run if any variable is
unset. Added AUTH_GATE_SECRET/USER/PASS to .env.example.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* refactor(tooling): migrate from black+isort+bandit to ruff

Replace three separate linting/formatting tools with a single ruff
invocation. Updates tox.ini (lint, format, pre-push, pre-commit envs),
.pre-commit-config.yaml, and CI workflow. Fixes all ruff errors
including unused imports, missing raise-from, and undefined names.
Ruff config maps existing bandit skips to equivalent S-rules.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

---------

Co-authored-by: Claude <noreply@anthropic.com>

src/infrastructure/hands/shell.py

@@ -19,7 +19,6 @@ import logging
 import shlex
 import time
 from dataclasses import dataclass, field
-from typing import Optional
 
 from config import settings
 
@@ -95,9 +94,9 @@ class ShellHand:
 
     def __init__(
         self,
-        allowed_prefixes: Optional[tuple[str, ...]] = None,
+        allowed_prefixes: tuple[str, ...] | None = None,
         default_timeout: int = 60,
-        working_dir: Optional[str] = None,
+        working_dir: str | None = None,
     ) -> None:
         self._allowed_prefixes = allowed_prefixes or DEFAULT_ALLOWED_PREFIXES
         self._default_timeout = default_timeout
@@ -114,7 +113,7 @@ class ShellHand:
     def enabled(self) -> bool:
         return self._enabled
 
-    def _validate_command(self, command: str) -> Optional[str]:
+    def _validate_command(self, command: str) -> str | None:
         """Validate a command against the allow-list.
 
         Returns None if valid, or an error message if blocked.
@@ -148,9 +147,9 @@ class ShellHand:
     async def run(
         self,
         command: str,
-        timeout: Optional[int] = None,
-        working_dir: Optional[str] = None,
-        env: Optional[dict] = None,
+        timeout: int | None = None,
+        working_dir: str | None = None,
+        env: dict | None = None,
     ) -> ShellResult:
         """Execute a shell command in a sandboxed environment.
 
@@ -197,7 +196,7 @@ class ShellHand:
                 stdout_bytes, stderr_bytes = await asyncio.wait_for(
                     proc.communicate(), timeout=effective_timeout
                 )
-            except asyncio.TimeoutError:
+            except TimeoutError:
                 proc.kill()
                 await proc.wait()
                 latency = (time.time() - start) * 1000