ci: enable ruff linting and pytest in CI pipeline

Uncomment the ruff check and pytest steps in the Gitea Actions build
workflow so that linting violations and test failures block image builds.
Fix all pre-existing ruff violations (E402 import ordering in analyzer.py,
F821 undefined name in api.py, I001 unsorted imports in test files, F401
unused import in test_rate_limit.py).

Closes leeworks-agents/SPARC#1559
Closes leeworks-agents/SPARC#1560

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/test_auth.py

@@ -175,6 +175,7 @@ class TestGetMe:
         from datetime import timedelta
 
         import jwt as pyjwt
+
         from SPARC.auth import JWT_ALGORITHM, JWT_SECRET
 
         payload = {

tests/test_rate_limit.py

@@ -1,7 +1,8 @@
 """Tests for rate limiting on auth endpoints."""
 
+from unittest.mock import MagicMock, patch
+
 import pytest
-from unittest.mock import Mock, patch, MagicMock
 from fastapi.testclient import TestClient
 
 from SPARC.api import app

tests/test_security.py

@@ -14,6 +14,7 @@ class TestJWTSecretStartupCheck:
         with patch.dict(os.environ, {"APP_ENV": "production"}):
             # Reload config to pick up the new APP_ENV
             import importlib
+
             import SPARC.config
             importlib.reload(SPARC.config)
 
@@ -31,6 +32,7 @@ class TestJWTSecretStartupCheck:
         """Starting with default secret and APP_ENV=development must not raise."""
         with patch.dict(os.environ, {"APP_ENV": "development"}):
             import importlib
+
             import SPARC.config
             importlib.reload(SPARC.config)
 
@@ -46,6 +48,7 @@ class TestJWTSecretStartupCheck:
         """Starting with a custom secret in production must not raise."""
         with patch.dict(os.environ, {"APP_ENV": "production"}):
             import importlib
+
             import SPARC.config
             importlib.reload(SPARC.config)
 
@@ -65,6 +68,7 @@ class TestJWTSecretStartupCheck:
             env.pop("APP_ENV", None)
             with patch.dict(os.environ, env, clear=True):
                 import importlib
+
                 import SPARC.config
                 importlib.reload(SPARC.config)
 
@@ -84,6 +88,7 @@ class TestCORSConfig:
         """When CORS_ORIGINS is unset, defaults to localhost origins."""
         with patch.dict(os.environ, {"CORS_ORIGINS": ""}):
             import importlib
+
             import SPARC.config
             importlib.reload(SPARC.config)
             assert SPARC.config.cors_origins == [
@@ -95,6 +100,7 @@ class TestCORSConfig:
         """Setting CORS_ORIGINS configures allowed origins."""
         with patch.dict(os.environ, {"CORS_ORIGINS": "https://sparc.example.com,https://app.example.com"}):
             import importlib
+
             import SPARC.config
             importlib.reload(SPARC.config)
             assert SPARC.config.cors_origins == [
@@ -109,6 +115,7 @@ class TestCORSConfig:
         """A single origin without comma works correctly."""
         with patch.dict(os.environ, {"CORS_ORIGINS": "https://sparc.example.com"}):
             import importlib
+
             import SPARC.config
             importlib.reload(SPARC.config)
             assert SPARC.config.cors_origins == ["https://sparc.example.com"]