ruff (#169)

* polish: streamline nav, extract inline styles, improve tablet UX

- Restructure desktop nav from 8+ flat links + overflow dropdown into
  5 grouped dropdowns (Core, Agents, Intel, System, More) matching
  the mobile menu structure to reduce decision fatigue
- Extract all inline styles from mission_control.html and base.html
  notification elements into mission-control.css with semantic classes
- Replace JS-built innerHTML with secure DOM construction in
  notification loader and chat history
- Add CONNECTING state to connection indicator (amber) instead of
  showing OFFLINE before WebSocket connects
- Add tablet breakpoint (1024px) with larger touch targets for
  Apple Pencil / stylus use and safe-area padding for iPad toolbar
- Add active-link highlighting in desktop dropdown menus
- Rename "Mission Control" page title to "System Overview" to
  disambiguate from the chat home page
- Add "Home — Timmy Time" page title to index.html

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* fix(security): move auth-gate credentials to environment variables

Hardcoded username, password, and HMAC secret in auth-gate.py replaced
with os.environ lookups. Startup now refuses to run if any variable is
unset. Added AUTH_GATE_SECRET/USER/PASS to .env.example.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

* refactor(tooling): migrate from black+isort+bandit to ruff

Replace three separate linting/formatting tools with a single ruff
invocation. Updates tox.ini (lint, format, pre-push, pre-commit envs),
.pre-commit-config.yaml, and CI workflow. Fixes all ruff errors
including unused imports, missing raise-from, and undefined names.
Ruff config maps existing bandit skips to equivalent S-rules.

https://claude.ai/code/session_015uPUoKyYa8M2UAcyk5Gt6h

---------

Co-authored-by: Claude <noreply@anthropic.com>

tox.ini

@@ -15,27 +15,23 @@ setenv =
 # ── Lint & Format ────────────────────────────────────────────────────────────
 
 [testenv:lint]
-description = Check formatting (black), import order (isort), security (bandit), no inline CSS
+description = Check formatting, imports, security (ruff), no inline CSS
 commands_pre =
 deps =
-    black
-    isort
-    bandit>=1.8.0
+    ruff>=0.8.0
 commands =
-    black --check --line-length 100 src/ tests/
-    isort --check-only --profile black --line-length 100 src/ tests/
-    bandit -r src/ -ll -s B101,B104,B307,B310,B324,B601,B608 -q
+    ruff check src/ tests/
+    ruff format --check src/ tests/
     bash -c 'files=$(grep -rl "<style" src/dashboard/templates/ --include="*.html" 2>/dev/null); if [ -n "$files" ]; then echo "ERROR: inline <style> blocks found — move CSS to static/css/mission-control.css:"; echo "$files"; exit 1; fi; echo "No inline CSS — OK"'
 
 [testenv:format]
-description = Auto-format code with black + isort
+description = Auto-format code with ruff
 commands_pre =
 deps =
-    black
-    isort
+    ruff>=0.8.0
 commands =
-    black --line-length 100 src/ tests/
-    isort --profile black --line-length 100 src/ tests/
+    ruff check --fix src/ tests/
+    ruff format src/ tests/
 
 [testenv:typecheck]
 description = Static type checking with mypy
@@ -127,13 +123,10 @@ commands =
 [testenv:pre-push]
 description = Local gate — lint + full CI suite (same as GitHub Actions)
 deps =
-    black
-    isort
-    bandit>=1.8.0
+    ruff>=0.8.0
 commands =
-    black --check --line-length 100 src/ tests/
-    isort --check-only --profile black --line-length 100 src/ tests/
-    bandit -r src/ -ll -s B101,B104,B307,B310,B324,B601,B608 -q
+    ruff check src/ tests/
+    ruff format --check src/ tests/
     bash -c 'files=$(grep -rl "<style" src/dashboard/templates/ --include="*.html" 2>/dev/null); if [ -n "$files" ]; then echo "ERROR: inline <style> blocks found — move CSS to static/css/mission-control.css:"; echo "$files"; exit 1; fi; echo "No inline CSS — OK"'
     mkdir -p reports
     pytest tests/ \
@@ -150,11 +143,10 @@ commands =
 [testenv:pre-commit]
 description = Fast pre-commit gate — format check + unit tests (30s budget)
 deps =
-    black
-    isort
+    ruff>=0.8.0
 commands =
-    black --check --line-length 100 src/ tests/
-    isort --check-only --profile black --line-length 100 src/ tests/
+    ruff check src/ tests/
+    ruff format --check src/ tests/
     pytest tests/ -q --tb=short \
         --ignore=tests/e2e \
         --ignore=tests/functional \