style: say which lint rules this repo keeps, then keep them

`[tool.ruff]` set a line length and a target version and nothing else, so which
rules ran depended on the installed ruff's defaults — fine while nobody ran it,
not fine for a CI job that can turn a push red because a tool changed its mind.

The set is named explicitly (E, F, I, UP, SIM, B, RUF) with three ignores that
are each a real decision rather than a shrug: B008, because FastAPI's whole
dependency idiom is a call in a default argument; E501, because wrapping prose
is a formatter's business; and RUF001, because the reports and the bot speak
Russian and "ambiguous character" is the wrong complaint about a string the
user is meant to read.

The 73 findings that remained are fixed — mostly `datetime.timezone.utc` →
`datetime.UTC`, `typing.Callable` → `collections.abc.Callable`, import order,
and unused `noqa` markers — plus seven by hand: `contextlib.suppress` for two
try/except/pass pairs, unpacking instead of list concatenation, one negated
return.

`ruff format` is deliberately *not* adopted: it would reformat 51 files, and
some of the layout here is hand-set (the comment tables, the DNS wire-format
structs) in ways a formatter flattens.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/app/services/auth_service.py

@@ -17,7 +17,7 @@ import hashlib
 import hmac
 import secrets
 import time
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from typing import Any
 
 from sqlalchemy import delete
@@ -84,7 +84,7 @@ def create_session(session: Session, method: str, session_days: int) -> AuthSess
     row = AuthSession(
         token=secrets.token_urlsafe(32),
         method=method,
-        expires_at=datetime.now(timezone.utc) + timedelta(days=session_days),
+        expires_at=datetime.now(UTC) + timedelta(days=session_days),
     )
     session.add(row)
     session.commit()
@@ -93,7 +93,7 @@ def create_session(session: Session, method: str, session_days: int) -> AuthSess
 
 def _aware(dt: datetime) -> datetime:
     """SQLite drops the tzinfo it was stored with; Postgres does not."""
-    return dt if dt.tzinfo else dt.replace(tzinfo=timezone.utc)
+    return dt if dt.tzinfo else dt.replace(tzinfo=UTC)
 
 
 def valid_session(session: Session, token: str | None) -> AuthSession | None:
@@ -102,7 +102,7 @@ def valid_session(session: Session, token: str | None) -> AuthSession | None:
     row = session.get(AuthSession, token)
     if row is None:
         return None
-    if _aware(row.expires_at) < datetime.now(timezone.utc):
+    if _aware(row.expires_at) < datetime.now(UTC):
         session.delete(row)
         session.commit()
         return None
@@ -117,7 +117,7 @@ def delete_session(session: Session, token: str | None) -> None:
 
 
 def _prune_expired(session: Session) -> None:
-    session.execute(delete(AuthSession).where(AuthSession.expires_at < datetime.now(timezone.utc)))
+    session.execute(delete(AuthSession).where(AuthSession.expires_at < datetime.now(UTC)))
 
 
 # --------------------------------------------------------------------------