refactor: modernize code quality tooling with Ruff

- Replace black, isort, and flake8 with Ruff (all-in-one linter and formatter)
- Add comprehensive pyproject.toml configuration
- Simplify Makefile code quality targets
- Configure exclusions for venv/.venv in pyproject.toml
- Auto-fix 1,359 linting issues across codebase

Benefits:
- Much faster builds (Ruff is written in Rust)
- Single tool replaces multiple tools
- More comprehensive rule set (UP, B, C4, SIM, PIE, RET, Q)
- All configuration centralized in pyproject.toml
- Better import sorting and formatting consistency

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/api/deps.py

@@ -32,18 +32,20 @@ The cookie path restrictions prevent cross-context cookie leakage:
 """
 
 import logging
-from typing import Optional
+from datetime import UTC
 
 from fastapi import Cookie, Depends, Request
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from sqlalchemy.orm import Session
 
 from app.core.database import get_db
-from app.exceptions import (AdminRequiredException,
-                            InsufficientPermissionsException,
-                            InvalidTokenException,
-                            UnauthorizedVendorAccessException,
-                            VendorNotFoundException)
+from app.exceptions import (
+    AdminRequiredException,
+    InsufficientPermissionsException,
+    InvalidTokenException,
+    UnauthorizedVendorAccessException,
+    VendorNotFoundException,
+)
 from middleware.auth import AuthManager
 from middleware.rate_limiter import RateLimiter
 from models.database.user import User
@@ -62,11 +64,11 @@ logger = logging.getLogger(__name__)
 
 
 def _get_token_from_request(
-    credentials: Optional[HTTPAuthorizationCredentials],
-    cookie_value: Optional[str],
+    credentials: HTTPAuthorizationCredentials | None,
+    cookie_value: str | None,
     cookie_name: str,
     request_path: str,
-) -> tuple[Optional[str], Optional[str]]:
+) -> tuple[str | None, str | None]:
     """
     Extract token from Authorization header or cookie.
 
@@ -86,7 +88,7 @@ def _get_token_from_request(
     if credentials:
         logger.debug(f"Token found in Authorization header for {request_path}")
         return credentials.credentials, "header"
-    elif cookie_value:
+    if cookie_value:
         logger.debug(f"Token found in {cookie_name} cookie for {request_path}")
         return cookie_value, "cookie"
 
@@ -118,8 +120,8 @@ def _validate_user_token(token: str, db: Session) -> User:
 
 def get_current_admin_from_cookie_or_header(
     request: Request,
-    credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
-    admin_token: Optional[str] = Cookie(None),
+    credentials: HTTPAuthorizationCredentials | None = Depends(security),
+    admin_token: str | None = Cookie(None),
     db: Session = Depends(get_db),
 ) -> User:
     """
@@ -205,8 +207,8 @@ def get_current_admin_api(
 
 def get_current_vendor_from_cookie_or_header(
     request: Request,
-    credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
-    vendor_token: Optional[str] = Cookie(None),
+    credentials: HTTPAuthorizationCredentials | None = Depends(security),
+    vendor_token: str | None = Cookie(None),
     db: Session = Depends(get_db),
 ) -> User:
     """
@@ -305,8 +307,8 @@ def get_current_vendor_api(
 
 def get_current_customer_from_cookie_or_header(
     request: Request,
-    credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
-    customer_token: Optional[str] = Cookie(None),
+    credentials: HTTPAuthorizationCredentials | None = Depends(security),
+    customer_token: str | None = Cookie(None),
     db: Session = Depends(get_db),
 ):
     """
@@ -331,7 +333,7 @@ def get_current_customer_from_cookie_or_header(
     Raises:
         InvalidTokenException: If no token or invalid token
     """
-    from datetime import datetime, timezone
+    from datetime import datetime
 
     from jose import JWTError, jwt
 
@@ -365,8 +367,8 @@ def get_current_customer_from_cookie_or_header(
 
         # Verify token hasn't expired
         exp = payload.get("exp")
-        if exp and datetime.fromtimestamp(exp, tz=timezone.utc) < datetime.now(
-            timezone.utc
+        if exp and datetime.fromtimestamp(exp, tz=UTC) < datetime.now(
+            UTC
         ):
             logger.warning(f"Expired customer token for customer_id={customer_id}")
             raise InvalidTokenException("Token has expired")
@@ -694,10 +696,10 @@ def get_user_permissions(
 
 def get_current_admin_optional(
     request: Request,
-    credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
-    admin_token: Optional[str] = Cookie(None),
+    credentials: HTTPAuthorizationCredentials | None = Depends(security),
+    admin_token: str | None = Cookie(None),
     db: Session = Depends(get_db),
-) -> Optional[User]:
+) -> User | None:
     """
     Get current admin user from admin_token cookie or Authorization header.
 
@@ -741,10 +743,10 @@ def get_current_admin_optional(
 
 def get_current_vendor_optional(
     request: Request,
-    credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
-    vendor_token: Optional[str] = Cookie(None),
+    credentials: HTTPAuthorizationCredentials | None = Depends(security),
+    vendor_token: str | None = Cookie(None),
     db: Session = Depends(get_db),
-) -> Optional[User]:
+) -> User | None:
     """
     Get current vendor user from vendor_token cookie or Authorization header.
 
@@ -788,10 +790,10 @@ def get_current_vendor_optional(
 
 def get_current_customer_optional(
     request: Request,
-    credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
-    customer_token: Optional[str] = Cookie(None),
+    credentials: HTTPAuthorizationCredentials | None = Depends(security),
+    customer_token: str | None = Cookie(None),
     db: Session = Depends(get_db),
-) -> Optional[User]:
+) -> User | None:
     """
     Get current customer user from customer_token cookie or Authorization header.