lint: replace no-op flake8 script with gating ruff check, fix findings

.gitea/workflows/ci.yml

@@ -71,6 +71,21 @@ jobs:
           docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:latest \
             detect --source /repo --no-banner --redact ${extra}
 
+  # Ruff lint on the FastAPI backend (config in ruff.toml). Replaces the old
+  # flake8 `|| true` npm script that never actually gated anything.
+  python-lint:
+    needs: skip-ci-check
+    if: needs.skip-ci-check.outputs.should-skip != '1'
+    runs-on: [homelab, self-hosted, linux]
+    container:
+      image: python:3.12-bookworm
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install ruff
+        run: pip install "ruff==0.16.0"
+      - name: Ruff check
+        run: ruff check backend
+
   # Vitest unit tests (viewer-frontend) — landed in PR #63, wired here.
   viewer-unit:
     needs: skip-ci-check