Add ruff linter/formatter for Python

- Add ruff as dev dependency
- Configure ruff in pyproject.toml with strict 88-char line limit
- Ignore B008 (FastAPI Depends pattern is standard)
- Allow longer lines in tests for readability
- Fix all lint issues in source files
- Add Makefile targets: lint-backend, format-backend, fix-backend

backend/routes/auth.py

@@ -1,5 +1,6 @@
 """Authentication routes for register, login, logout, and current user."""
-from datetime import datetime, timezone
+
+from datetime import UTC, datetime
 
 from fastapi import APIRouter, Depends, HTTPException, Response, status
 from sqlalchemy import select
@@ -9,18 +10,17 @@ from auth import (
     ACCESS_TOKEN_EXPIRE_MINUTES,
     COOKIE_NAME,
     COOKIE_SECURE,
-    get_password_hash,
-    get_user_by_email,
     authenticate_user,
+    build_user_response,
     create_access_token,
     get_current_user,
-    build_user_response,
+    get_password_hash,
+    get_user_by_email,
 )
 from database import get_db
 from invite_utils import normalize_identifier
-from models import User, Role, ROLE_REGULAR, Invite, InviteStatus
-from schemas import UserLogin, UserResponse, RegisterWithInvite
-
+from models import ROLE_REGULAR, Invite, InviteStatus, Role, User
+from schemas import RegisterWithInvite, UserLogin, UserResponse
 
 router = APIRouter(prefix="/api/auth", tags=["auth"])
 
@@ -52,9 +52,8 @@ async def register(
     """Register a new user using an invite code."""
     # Validate invite
     normalized_identifier = normalize_identifier(user_data.invite_identifier)
-    result = await db.execute(
-        select(Invite).where(Invite.identifier == normalized_identifier)
-    )
+    query = select(Invite).where(Invite.identifier == normalized_identifier)
+    result = await db.execute(query)
     invite = result.scalar_one_or_none()
 
     # Return same error for not found, spent, and revoked to avoid information leakage
@@ -90,7 +89,7 @@ async def register(
     # Mark invite as spent
     invite.status = InviteStatus.SPENT
     invite.used_by_id = user.id
-    invite.spent_at = datetime.now(timezone.utc)
+    invite.spent_at = datetime.now(UTC)
 
     await db.commit()
     await db.refresh(user)