Make CI ruff/pytest gates hard, fix stale tests

Removes || true from the ruff and pytest steps (job names unchanged so branch protection contexts still match), adds [tool.ruff] config (E4/E7/E9/F/I, line-length 120), applies ruff autofixes, and rewrites tests that had drifted from the current calendar/auth/main APIs — failures the soft gates had been hiding.

.gitea/workflows/ci.yml

@@ -48,8 +48,8 @@ jobs:
           if [ -f requirements-dev.txt ]; then pip install -r requirements-dev.txt --break-system-packages; fi
           pip install bandit pip-audit ruff --break-system-packages
 
-      - name: Ruff lint
-        run: ruff check . || true
+      - name: Ruff lint (hard gate)
+        run: ruff check .
 
       - name: Bandit (advisory)
         run: bandit -r . -q || true
@@ -57,14 +57,10 @@ jobs:
       - name: pip-audit (advisory)
         run: pip-audit -r requirements.txt 2>/dev/null || pip-audit 2>/dev/null || true
 
-      - name: Pytest
+      - name: Pytest (hard gate)
         run: |
-          if [ -d tests ] || ls test_*.py *_test.py 2>/dev/null; then
-            pip install pytest --break-system-packages
-            pytest -q || true
-          else
-            echo "No tests found — skip"
-          fi
+          pip install pytest --break-system-packages
+          pytest -q
 
   secret-scan:
     needs: skip-ci-check