fix(api): clear ruff lint errors blocking CI

- remove unused imports + sort imports (ruff --fix)
- contacts/models: TYPE_CHECKING import for Tag forward-ref (F821)
- wrap long APIRouter/Query lines (E501)
- ruff per-file-ignore E402 for tests/conftest (env set before src import)

Author: gracefullight

apps/api/pyproject.toml

@@ -42,6 +42,11 @@ extend-exclude = ["alembic"]
 [tool.ruff.lint]
 select = ["E", "F", "I", "W", "UP"]
 
+[tool.ruff.lint.per-file-ignores]
+# conftest sets JWT_SIGNING_KEY in os.environ before importing src.* (auth.py
+# fails fast without it), so module-level imports cannot all sit at the top.
+"tests/conftest.py" = ["E402"]
+
 [tool.mypy]
 python_version = "3.12"
 warn_return_any = true

apps/api/src/auth/router.py

@@ -17,13 +17,12 @@
 from typing import Annotated
 
 import httpx
-from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from fastapi import APIRouter, Depends, HTTPException, Query
 from fastapi.responses import RedirectResponse
 from redis.asyncio import Redis
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.auth.oauth import (
-    PROVIDER_CONFIG,
     SUPPORTED_PROVIDERS,
     _apple_credentials_present,
     build_authorization_url,

apps/api/src/contacts/models.py

@@ -1,11 +1,15 @@
 import datetime
+from typing import TYPE_CHECKING
 
 import sqlalchemy as sa
 from sqlalchemy import DateTime, Float, ForeignKey, PrimaryKeyConstraint, String, Text, func
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from src.lib.database import Base
 
+if TYPE_CHECKING:
+    from src.tags.models import Tag
+
 
 class ContactTag(Base):
     __tablename__ = "contact_tag"
@@ -49,7 +53,7 @@ class Contact(Base):
     # ORM then inserts only (contact_id, tag_id) and lets the DB apply the
     # server defaults for color and updated_at.
     # overlaps="contact_id,tag_id" silences the SA2.0 relationship overlap warning.
-    tags: Mapped[list["Tag"]] = relationship(  # type: ignore[name-defined]
+    tags: Mapped[list["Tag"]] = relationship(
         "Tag",
         secondary=lambda: ContactTag.__table__,
         lazy="selectin",

apps/api/src/contacts/repository.py

@@ -1,7 +1,7 @@
 import datetime
 
-from sqlalchemy import select
 from sqlalchemy import func as sa_func
+from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.contacts.models import Contact, ContactTag

apps/api/src/experiences/router.py

@@ -8,7 +8,11 @@
 from src.lib.exceptions import ApiResponse
 from src.lib.rate_limit import check_data_rate_limit
 
-router = APIRouter(prefix="/contacts/{contact_id}/experiences", tags=["experiences"], dependencies=[Depends(check_data_rate_limit)])
+router = APIRouter(
+    prefix="/contacts/{contact_id}/experiences",
+    tags=["experiences"],
+    dependencies=[Depends(check_data_rate_limit)],
+)
 
 
 @router.get("")

apps/api/src/graph/router.py

@@ -16,7 +16,10 @@
 @router.get("/data")
 async def get_graph_data(
     search: str | None = Query(default=None, description="Filter nodes by contact name (case-insensitive)"),
-    type: LinkType | None = Query(default=None, description="Filter links by LinkType (colleague|classmate|friend|other)"),
+    type: LinkType | None = Query(
+        default=None,
+        description="Filter links by LinkType (colleague|classmate|friend|other)",
+    ),
     user_id: str = Depends(get_current_user_id),
     session: AsyncSession = Depends(get_session),
     redis: Redis = Depends(get_redis),

apps/api/src/main.py

@@ -28,7 +28,6 @@
 from src.tags.router import router as tags_router
 from src.upload.router import router as upload_router
 
-
 ENV = os.getenv("ENV", "dev")
 IS_PROD = ENV == "prod"
 

apps/api/src/notifications/service.py

@@ -28,5 +28,5 @@ async def unregister(self, *, user_id: str, token: str) -> None:
         )
         if not deleted:
             raise NotFoundException(
-                message=f"Device token not found for the current user"
+                message="Device token not found for the current user"
             )

apps/api/tests/conftest.py

@@ -24,7 +24,6 @@
 from src.auth.models import User
 from src.contacts.models import Contact
 from src.experiences.models import Experience
-from src.tags.models import Tag
 from src.lib.auth import (
     JWT_ALGORITHM,
     JWT_AUDIENCE,
@@ -37,6 +36,7 @@
 from src.lib.redis import get_redis
 from src.main import app
 from src.organizations.models import Organization
+from src.tags.models import Tag
 
 TEST_DATABASE_URL = os.getenv(
     "TEST_DATABASE_URL",

apps/api/tests/test_apple_auth.py

@@ -7,8 +7,6 @@
 import os
 from unittest.mock import patch
 
-import pytest
-
 
 async def test_apple_exchange_returns_501_when_unconfigured(client):
     """POST /auth/exchange with provider=apple must return 501 when Apple env vars are absent."""
@@ -24,7 +22,6 @@ async def test_apple_exchange_returns_501_when_unconfigured(client):
         clear=False,
     ):
         # Force the module-level _apple_credentials_present() to see empty values.
-        import importlib
 
         import src.auth.oauth as oauth_mod
 
@@ -80,7 +77,6 @@ async def test_unsupported_provider_returns_400(client):
 
 async def test_apple_credentials_present_helper_false_when_env_empty():
     """Unit test: _apple_credentials_present() returns False when env vars are unset."""
-    import src.auth.oauth as oauth_mod
 
     with patch.dict(
         os.environ,