fix(lint): resolve all ruff lint errors

Add ruff config to exclude alembic E402, SQLAlchemy F821, and pre-existing
E501 line-length issues. Auto-fix 69 unused imports and 2 f-strings without
placeholders. Manually fix 8 unused variables. Apply ruff format to 127 files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/config_snapshot_subscriber.py

@@ -89,9 +89,11 @@ async def handle_config_snapshot(msg) -> None:
 
     collected_at_raw = data.get("collected_at")
     try:
-        collected_at = datetime.fromisoformat(
-            collected_at_raw.replace("Z", "+00:00")
-        ) if collected_at_raw else datetime.now(timezone.utc)
+        collected_at = (
+            datetime.fromisoformat(collected_at_raw.replace("Z", "+00:00"))
+            if collected_at_raw
+            else datetime.now(timezone.utc)
+        )
     except (ValueError, AttributeError):
         collected_at = datetime.now(timezone.utc)
 
@@ -131,9 +133,7 @@ async def handle_config_snapshot(msg) -> None:
         # --- Encrypt via OpenBao Transit ---
         openbao = OpenBaoTransitService()
         try:
-            encrypted_text = await openbao.encrypt(
-                tenant_id, config_text.encode("utf-8")
-            )
+            encrypted_text = await openbao.encrypt(tenant_id, config_text.encode("utf-8"))
         except Exception as exc:
             logger.warning(
                 "Transit encrypt failed for device %s tenant %s: %s",
@@ -207,7 +207,8 @@ async def handle_config_snapshot(msg) -> None:
         except Exception as exc:
             logger.warning(
                 "Diff generation failed for device %s (non-fatal): %s",
-                device_id, exc,
+                device_id,
+                exc,
             )
 
     logger.info(
@@ -233,9 +234,7 @@ async def _subscribe_with_retry(js) -> None:
                 stream="DEVICE_EVENTS",
                 manual_ack=True,
             )
-            logger.info(
-                "NATS: subscribed to config.snapshot.> (durable: config_snapshot_ingest)"
-            )
+            logger.info("NATS: subscribed to config.snapshot.> (durable: config_snapshot_ingest)")
             return
         except Exception as exc:
             if attempt < max_attempts: