fix(lint): resolve all ruff lint errors

Add ruff config to exclude alembic E402, SQLAlchemy F821, and pre-existing
E501 line-length issues. Auto-fix 69 unused imports and 2 f-strings without
placeholders. Manually fix 8 unused variables. Apply ruff format to 127 files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/schemas/auth.py

@@ -67,11 +67,13 @@ class MessageResponse(BaseModel):
 
 class SRPInitRequest(BaseModel):
     """Step 1 request: client sends email to begin SRP handshake."""
+
     email: EmailStr
 
 
 class SRPInitResponse(BaseModel):
     """Step 1 response: server returns ephemeral B and key derivation salts."""
+
     salt: str  # hex-encoded SRP salt
     server_public: str  # hex-encoded server ephemeral B
     session_id: str  # Redis session key nonce
@@ -81,6 +83,7 @@ class SRPInitResponse(BaseModel):
 
 class SRPVerifyRequest(BaseModel):
     """Step 2 request: client sends proof M1 to complete handshake."""
+
     email: EmailStr
     session_id: str
     client_public: str  # hex-encoded client ephemeral A
@@ -89,6 +92,7 @@ class SRPVerifyRequest(BaseModel):
 
 class SRPVerifyResponse(BaseModel):
     """Step 2 response: server returns tokens and proof M2."""
+
     access_token: str
     refresh_token: str
     token_type: str = "bearer"
@@ -98,6 +102,7 @@ class SRPVerifyResponse(BaseModel):
 
 class SRPRegisterRequest(BaseModel):
     """Used during registration to store SRP verifier and key set."""
+
     srp_salt: str  # hex-encoded
     srp_verifier: str  # hex-encoded
     encrypted_private_key: str  # base64-encoded
@@ -114,10 +119,12 @@ class SRPRegisterRequest(BaseModel):
 
 class DeleteAccountRequest(BaseModel):
     """Request body for account self-deletion. User must type 'DELETE' to confirm."""
+
     confirmation: str  # Must be "DELETE" to confirm
 
 
 class DeleteAccountResponse(BaseModel):
     """Response after successful account deletion."""
+
     message: str
     deleted: bool

backend/app/schemas/certificate.py

@@ -10,6 +10,7 @@ from pydantic import BaseModel, ConfigDict
 # Request schemas
 # ---------------------------------------------------------------------------
 
+
 class CACreateRequest(BaseModel):
     """Request to generate a new root CA for the tenant."""
 
@@ -34,6 +35,7 @@ class BulkCertDeployRequest(BaseModel):
 # Response schemas
 # ---------------------------------------------------------------------------
 
+
 class CAResponse(BaseModel):
     """Public details of a tenant's Certificate Authority (no private key)."""
 

backend/app/schemas/device.py

@@ -117,6 +117,7 @@ class SubnetScanRequest(BaseModel):
     def validate_cidr(cls, v: str) -> str:
         """Validate that the value is a valid CIDR notation and RFC 1918 private range."""
         import ipaddress
+
         try:
             network = ipaddress.ip_network(v, strict=False)
         except ValueError as e:
@@ -239,6 +240,7 @@ class DeviceTagCreate(BaseModel):
         if v is None:
             return v
         import re
+
         if not re.match(r"^#[0-9A-Fa-f]{6}$", v):
             raise ValueError("Color must be a valid 6-digit hex color (e.g. #FF5733)")
         return v
@@ -256,6 +258,7 @@ class DeviceTagUpdate(BaseModel):
         if v is None:
             return v
         import re
+
         if not re.match(r"^#[0-9A-Fa-f]{6}$", v):
             raise ValueError("Color must be a valid 6-digit hex color (e.g. #FF5733)")
         return v

backend/app/schemas/vpn.py

@@ -12,11 +12,15 @@ from pydantic import BaseModel
 
 class VpnSetupRequest(BaseModel):
     """Request to enable VPN for a tenant."""
-    endpoint: Optional[str] = None  # public hostname:port — if blank, devices must be configured manually
+
+    endpoint: Optional[str] = (
+        None  # public hostname:port — if blank, devices must be configured manually
+    )
 
 
 class VpnConfigResponse(BaseModel):
     """VPN server configuration (never exposes private key)."""
+
     model_config = {"from_attributes": True}
 
     id: uuid.UUID
@@ -33,6 +37,7 @@ class VpnConfigResponse(BaseModel):
 
 class VpnConfigUpdate(BaseModel):
     """Update VPN configuration."""
+
     endpoint: Optional[str] = None
     is_enabled: Optional[bool] = None
 
@@ -42,12 +47,14 @@ class VpnConfigUpdate(BaseModel):
 
 class VpnPeerCreate(BaseModel):
     """Add a device as a VPN peer."""
+
     device_id: uuid.UUID
     additional_allowed_ips: Optional[str] = None  # comma-separated subnets for site-to-site routing
 
 
 class VpnPeerResponse(BaseModel):
     """VPN peer info (never exposes private key)."""
+
     model_config = {"from_attributes": True}
 
     id: uuid.UUID
@@ -66,6 +73,7 @@ class VpnPeerResponse(BaseModel):
 
 class VpnOnboardRequest(BaseModel):
     """Combined device creation + VPN peer onboarding."""
+
     hostname: str
     username: str
     password: str
@@ -73,6 +81,7 @@ class VpnOnboardRequest(BaseModel):
 
 class VpnOnboardResponse(BaseModel):
     """Response from onboarding — device, peer, and RouterOS commands."""
+
     device_id: uuid.UUID
     peer_id: uuid.UUID
     hostname: str
@@ -82,6 +91,7 @@ class VpnOnboardResponse(BaseModel):
 
 class VpnPeerConfig(BaseModel):
     """Full peer config for display/export — includes private key for device setup."""
+
     peer_private_key: str
     peer_public_key: str
     assigned_ip: str

backend/app/schemas/winbox_remote.py

@@ -57,6 +57,7 @@ class RemoteWinboxDuplicateDetail(BaseModel):
 
 class RemoteWinboxSessionItem(BaseModel):
     """Used in the combined active sessions list."""
+
     session_id: uuid.UUID
     status: RemoteWinboxState
     created_at: datetime