style: ruff's own fixes, mechanically applied

`ruff check .` had gone unrun long enough to report 568 errors, which is the
same as having no linter: the next real finding would have been invisible in the
noise. This is the 521 it fixes by itself, in 173 files, and nothing else — the
98 it cannot fix are the next commit.

What actually changed: import sorting (225), imports nobody used (87, none of
them a re-export — no `__init__.py` is touched, which was the one way this could
have broken an import elsewhere), `datetime.timezone.utc` to `datetime.UTC` (69)
and `asyncio.TimeoutError` to `TimeoutError` (18), both plain aliases on the 3.12
this project requires, `Optional[X]` to `X | None` (24), and f-strings with
nothing to interpolate (19).

Checked rather than assumed: every module in the three packages still imports,
and the suite is 2893 passed — the same count, test for test, as the merge
before it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

59 files changed, 262 insertions, 264 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/admin.py b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
index 7ca1e68..d8e13e9 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/admin.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
@@ -6,19 +6,18 @@ Separate from moderation.py (which handles public reporting and content blocklis
 """
 
 import logging
-from datetime import datetime, timezone
 
 from fastapi import APIRouter, Depends, HTTPException, Query
 from pydantic import BaseModel
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from meshbay_hub.auth import decrypt_email
+from meshbay_hub import hub_settings
 from meshbay_hub.api.deps import require_admin, require_moderator, user_is_admin
 from meshbay_hub.api.revocation import get_connected_node_count, is_node_connected
+from meshbay_hub.auth import decrypt_email
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import Group, GroupMember, IPLog, Node, User
-from meshbay_hub import hub_settings
 
 log = logging.getLogger(__name__)
 
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/deps.py b/packages/meshbay-hub/src/meshbay_hub/api/deps.py
index 907a481..501be9d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/deps.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/deps.py
@@ -8,8 +8,8 @@ JWT scope enforcement:
 """
 
 from fastapi import Depends, Header, HTTPException, status
-from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
 
 from meshbay_hub.auth import decode_access_token
 from meshbay_hub.db.engine import get_db
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/federation.py b/packages/meshbay-hub/src/meshbay_hub/api/federation.py
index 9e252c6..755639e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/federation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/federation.py
@@ -23,18 +23,18 @@ Protocol version: MHP 0.1
 import logging
 import time
 import uuid
+from datetime import UTC
 
 import jwt
-from fastapi import APIRouter, Depends, HTTPException, Header
+from fastapi import APIRouter, Depends, Header, HTTPException
+from meshbay_common import MHP_VERSION
 from pydantic import BaseModel
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from meshbay_common import MHP_VERSION
 from meshbay_hub import __version__, hub_settings
 from meshbay_hub.api.deps import require_admin
-from meshbay_hub.auth import (
-    hub_id, hub_private_key_pem, hub_public_key_pem)
+from meshbay_hub.auth import hub_id, hub_private_key_pem, hub_public_key_pem
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import FederatedGroup, Group, HubPeer, User
 
@@ -244,8 +244,8 @@ async def receive_directory(
     if len(body.groups) > MAX_FEDERATED_GROUPS_PER_PUSH:
         raise HTTPException(status_code=413, detail="Too many groups in one push")
 
-    from datetime import datetime, timezone
-    now = datetime.now(timezone.utc)
+    from datetime import datetime
+    now = datetime.now(UTC)
     have = await db.scalar(
         select(func.count()).select_from(FederatedGroup)
         .where(FederatedGroup.source_hub == sender)) or 0
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
index 72ba194..3a11345 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
@@ -1,22 +1,27 @@
 """Group endpoints — /v1/groups/*"""
 
 import re
+from datetime import UTC, datetime
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from pydantic import BaseModel
-from datetime import datetime, timezone
 from sqlalchemy import func, or_, select, update
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from meshbay_hub import hub_settings, mail
-from meshbay_hub.auth import decrypt_email
 from meshbay_hub.api.deps import get_current_user, require_user_scope
 from meshbay_hub.api.middleware import limiter
 from meshbay_hub.api.netutil import client_ip
+from meshbay_hub.auth import decrypt_email
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import (
-    FederatedGroup, Group, GroupMember, IPLog, SwarmSource, User,
+    FederatedGroup,
+    Group,
+    GroupMember,
+    IPLog,
+    SwarmSource,
+    User,
 )
 
 router = APIRouter(prefix="/v1/groups", tags=["groups"])
@@ -97,7 +102,7 @@ async def touch_group_activity(
     await db.execute(
         update(Group)
         .where(Group.id == group_id)
-        .values(last_activity_at=datetime.now(timezone.utc)))
+        .values(last_activity_at=datetime.now(UTC)))
     await db.commit()
     return {"ok": True}
 
@@ -261,9 +266,9 @@ async def swarm_register(
             detail="endpoint must be '<webrtc|quic>:<port>' — a port on the "
                    "registering node, not an address")
 
-    from datetime import datetime, timezone
+    from datetime import datetime
     existing = await db.get(SwarmSource, (body.content_hash, current_user.id))
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     if existing:
         existing.endpoint  = body.endpoint
         existing.last_seen = now
@@ -297,8 +302,8 @@ async def swarm_sources(
     Authenticated (H7): an open endpoint lets anyone probe whether a given file
     exists anywhere in the network and which node holds it.
     """
-    from datetime import datetime, timezone, timedelta
-    cutoff = datetime.now(timezone.utc) - timedelta(minutes=30)
+    from datetime import datetime, timedelta
+    cutoff = datetime.now(UTC) - timedelta(minutes=30)
     result = await db.execute(
         select(SwarmSource)
         .where(
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/hub.py b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
index 94e9b3c..cab60c8 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/hub.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
@@ -1,9 +1,9 @@
 """Hub info endpoints — /v1/hub/*"""
 
 from fastapi import APIRouter, Depends
+from meshbay_common import MHP_VERSION, MNP_VERSION
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from meshbay_common import MNP_VERSION, MHP_VERSION
 from meshbay_hub import __version__, hub_settings
 from meshbay_hub.api import federation
 from meshbay_hub.auth import hub_public_key_pem
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/moderation.py b/packages/meshbay-hub/src/meshbay_hub/api/moderation.py
index ee10cbc..35c688c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/moderation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/moderation.py
@@ -23,7 +23,6 @@ Node integration:
 """
 
 import logging
-from datetime import datetime, timezone
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from pydantic import BaseModel
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
index 83b60f2..7478173 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
@@ -1,20 +1,20 @@
 """Node endpoints — /v1/nodes/*"""
 
-from datetime import datetime, timezone
 import base64
 import time
+from datetime import UTC, datetime
 
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
 from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
 from fastapi import APIRouter, Depends, HTTPException, Request
 from pydantic import BaseModel
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from meshbay_hub.auth import issue_access_token
 from meshbay_hub.api.deps import get_current_user
 from meshbay_hub.api.middleware import limiter
 from meshbay_hub.api.netutil import client_ip
+from meshbay_hub.auth import issue_access_token
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import GroupMember, IPLog, Node, User
 
@@ -156,7 +156,7 @@ async def announce_node(
     if node is not None:
         node.endpoint_hint = body.endpoint_hint
         node.observed_ip = seen_from
-        node.last_seen = datetime.now(timezone.utc)
+        node.last_seen = datetime.now(UTC)
         db.add(IPLog(user_id=current_user.id, event="node_announce",
                      ip_address=seen_from, detail=body.endpoint_hint))
         await db.commit()
@@ -182,7 +182,7 @@ async def announce_node(
         pk_node=body.pk_node,
         endpoint_hint=body.endpoint_hint,
         observed_ip=seen_from,
-        last_seen=datetime.now(timezone.utc),
+        last_seen=datetime.now(UTC),
     )
     db.add(node)
     db.add(IPLog(
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/notifications.py b/packages/meshbay-hub/src/meshbay_hub/api/notifications.py
index b5783ab..d96ec18 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/notifications.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/notifications.py
@@ -19,9 +19,9 @@ migration for no gain, and `unread_only` stays because it is what an older
 interface asks for and it still answers correctly — every row is unread.
 """
 
-from fastapi import APIRouter, Depends, HTTPException, Query
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
+from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy import delete, func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -182,7 +182,7 @@ async def create_notification(
             existing.detail = detail
             existing.link = link
             existing.read = False
-            existing.created_at = datetime.now(timezone.utc)
+            existing.created_at = datetime.now(UTC)
             await db.flush()
             return existing
 
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
index 1f1f5c5..f8cae8a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
@@ -26,23 +26,21 @@ and close active connections for that user.
 """
 
 import asyncio
-import base64
 import json
 import logging
 import time
 import uuid
-from datetime import datetime, timezone
-from typing import Any
+from datetime import UTC, datetime
 
+import jwt
 from fastapi import APIRouter, Depends, HTTPException, Request, WebSocket, WebSocketDisconnect
+from meshbay_common.background import spawn
 from pydantic import BaseModel
 from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
-import jwt
-from meshbay_common.background import spawn
-from meshbay_hub.auth import hub_public_key_pem, decode_access_token
 from meshbay_hub.api.deps import get_current_user, require_admin
+from meshbay_hub.auth import decode_access_token
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import Group, GroupMember, IPLog, Node, User
 
@@ -143,7 +141,7 @@ async def _mark_hosted(group_ids: list[str]) -> None:
             await db.execute(
                 update(Group)
                 .where(Group.id.in_(group_ids), Group.hosted_at.is_(None))
-                .values(hosted_at=datetime.now(timezone.utc)))
+                .values(hosted_at=datetime.now(UTC)))
             await db.commit()
     except Exception as e:
         # A group that stays unhosted in the table is visible to its owner and
@@ -169,7 +167,7 @@ async def broadcast_revocation(token: str) -> int:
 
 def _sign_revocation(target: str, target_id: str, reason: str) -> str:
     """Issue a signed revocation token (JWT EdDSA)."""
-    from meshbay_hub.auth import _hub_sk_pem, _hub_id
+    from meshbay_hub.auth import _hub_id, _hub_sk_pem
     now = int(time.time())
     payload = {
         "type":       "revocation",
@@ -208,9 +206,9 @@ async def _handle_chat_notify(group_id: str, sender_name: str, sender_user_id: s
                     (node_id or "?")[:8])
         return
     try:
-        from meshbay_hub.db.engine import get_session_factory
-        from meshbay_hub.db.models import GroupMember, Group
         from meshbay_hub.api.notifications import create_notification
+        from meshbay_hub.db.engine import get_session_factory
+        from meshbay_hub.db.models import Group, GroupMember
 
         async with get_session_factory()() as db:
             group = await db.get(Group, group_id)
@@ -478,7 +476,7 @@ async def notify_incoming(
 
     try:
         await asyncio.wait_for(event.wait(), timeout=5.0)
-    except asyncio.TimeoutError:
+    except TimeoutError:
         raise HTTPException(status_code=504, detail="Node did not respond in time")
     finally:
         _punch_events.pop(node_id, None)
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
index bc03b45..8a10822 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
@@ -25,8 +25,8 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from meshbay_hub import hub_settings
 from meshbay_hub.api.deps import get_current_user
 from meshbay_hub.api.middleware import limiter
-from meshbay_hub.db.engine import get_db
 from meshbay_hub.api.netutil import client_ip
+from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import Group, GroupMember, IPLog, User
 
 log = logging.getLogger(__name__)
@@ -167,7 +167,7 @@ async def webrtc_offer(
 
         try:
             answer = await asyncio.wait_for(answer_future, timeout=15.0)
-        except asyncio.TimeoutError:
+        except TimeoutError:
             raise HTTPException(
                 status_code=504, detail="Node did not respond with WebRTC answer")
 
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index 0394f53..ee8aabc 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -6,7 +6,7 @@ import re
 import secrets
 import time
 import uuid
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
 from fastapi import APIRouter, Depends, HTTPException, Request
@@ -33,8 +33,17 @@ from meshbay_hub.auth import (
 from meshbay_hub.config import HubConfig
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import (
-    EmailVerification, Group, GroupMember, IPLog, Node, Notification,
-    RefreshToken, SwarmSource, User, UserDevice, UserPreference,
+    EmailVerification,
+    Group,
+    GroupMember,
+    IPLog,
+    Node,
+    Notification,
+    RefreshToken,
+    SwarmSource,
+    User,
+    UserDevice,
+    UserPreference,
 )
 
 log = logging.getLogger(__name__)
@@ -61,7 +70,7 @@ async def _refresh_expiry(db: AsyncSession, family_id: str | None = None) -> dat
     renewals of a tab that is being used.
     """
     limits = await hub_settings.session_limits(db)
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     idle = max(limits["refresh_idle_hours"] * 3600, _ttl() + 3600)
     started = now
     if family_id is not None:
@@ -69,7 +78,7 @@ async def _refresh_expiry(db: AsyncSession, family_id: str | None = None) -> dat
             select(func.min(RefreshToken.created_at))
             .where(RefreshToken.family_id == family_id))
         if first is not None:
-            started = first if first.tzinfo else first.replace(tzinfo=timezone.utc)
+            started = first if first.tzinfo else first.replace(tzinfo=UTC)
     return min(now + timedelta(seconds=idle),
                started + timedelta(hours=limits["max_hours"]))
 
@@ -193,7 +202,7 @@ async def register(
                     EmailVerification.user_id == found.id,
                     EmailVerification.purpose == "registration",
                     EmailVerification.created_at
-                    > datetime.now(timezone.utc)
+                    > datetime.now(UTC)
                     - timedelta(seconds=resend_cooldown),
                 ))
             if not recent.first():
@@ -270,7 +279,7 @@ async def _create_and_send_verification(
         code=code,
         purpose="registration",
         user_id=user.id,
-        expires_at=datetime.now(timezone.utc) + timedelta(seconds=VERIFICATION_TTL),
+        expires_at=datetime.now(UTC) + timedelta(seconds=VERIFICATION_TTL),
     ))
     await db.flush()
     await mail.send_off_loop(
@@ -292,7 +301,7 @@ async def verify_email(
 ):
     """Verify a registration email with the code received by mail."""
     eh = hash_email_blind(body.email)
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
 
     result = await db.execute(
         select(EmailVerification).where(
@@ -306,7 +315,7 @@ async def verify_email(
         raise HTTPException(status_code=404,
                             detail="No pending verification for this email")
 
-    if verif.expires_at.replace(tzinfo=timezone.utc) < now:
+    if verif.expires_at.replace(tzinfo=UTC) < now:
         raise HTTPException(status_code=410, detail="Verification code expired")
 
     if verif.attempts >= VERIFICATION_MAX_ATTEMPTS:
@@ -603,7 +612,7 @@ async def device_auth(
         await db.commit()
         raise HTTPException(status_code=401, detail="Invalid signature")
 
-    matched.last_seen = datetime.now(timezone.utc)
+    matched.last_seen = datetime.now(UTC)
 
     memberships = await db.execute(
         select(GroupMember.group_id).where(GroupMember.user_id == user.id))
@@ -650,7 +659,7 @@ async def token_refresh(
         await db.commit()
         raise HTTPException(status_code=401, detail="Token reuse detected — family revoked")
 
-    if rt.expires_at.replace(tzinfo=timezone.utc) < datetime.now(timezone.utc):
+    if rt.expires_at.replace(tzinfo=UTC) < datetime.now(UTC):
         raise HTTPException(status_code=401, detail="Expired refresh token")
 
     user = await db.get(User, rt.user_id)
@@ -659,7 +668,7 @@ async def token_refresh(
 
     # The family's first sign-in was longer ago than any session may last.
     expires_at = await _refresh_expiry(db, rt.family_id)
-    if expires_at <= datetime.now(timezone.utc):
+    if expires_at <= datetime.now(UTC):
         await db.execute(
             update(RefreshToken)
             .where(RefreshToken.family_id == rt.family_id)
@@ -779,7 +788,7 @@ async def update_profile(
             cooldown = await hub_settings.get_int(
                 db, "mail.email_change_cooldown",
                 hub_settings.mail_default("email_change_cooldown"))
-            since = datetime.now(timezone.utc) - timedelta(seconds=cooldown)
+            since = datetime.now(UTC) - timedelta(seconds=cooldown)
             recent = await db.execute(
                 select(IPLog).where(
                     IPLog.user_id == current_user.id,
@@ -820,7 +829,7 @@ async def update_profile(
             code=code,
             purpose="email_change",
             user_id=current_user.id,
-            expires_at=datetime.now(timezone.utc) + timedelta(seconds=VERIFICATION_TTL),
+            expires_at=datetime.now(UTC) + timedelta(seconds=VERIFICATION_TTL),
         ))
         db.add(IPLog(user_id=current_user.id, event="email_change_request",
                      ip_address=client_ip(request)))
@@ -860,7 +869,7 @@ async def verify_email_change(
     db: AsyncSession = Depends(get_db),
 ):
     """Confirm an email change with the code sent to the new address."""
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
 
     result = await db.execute(
         select(EmailVerification).where(
@@ -874,7 +883,7 @@ async def verify_email_change(
         raise HTTPException(status_code=404,
                             detail="No pending email change")
 
-    if verif.expires_at.replace(tzinfo=timezone.utc) < now:
+    if verif.expires_at.replace(tzinfo=UTC) < now:
         raise HTTPException(status_code=410, detail="Verification code expired")
 
     if verif.attempts >= VERIFICATION_MAX_ATTEMPTS:
@@ -1090,7 +1099,7 @@ async def password_reset_request(
                 EmailVerification.user_id == user.id,
                 EmailVerification.purpose == "password_reset",
                 EmailVerification.created_at
-                > datetime.now(timezone.utc) - timedelta(seconds=reset_cooldown),
+                > datetime.now(UTC) - timedelta(seconds=reset_cooldown),
             ))
         if recent.first():
             return {"status": "sent_if_exists"}
@@ -1110,7 +1119,7 @@ async def password_reset_request(
             code=code,
             purpose="password_reset",
             user_id=user.id,
-            expires_at=datetime.now(timezone.utc)
+            expires_at=datetime.now(UTC)
             + timedelta(seconds=PASSWORD_RESET_TTL),
         ))
         db.add(IPLog(user_id=user.id, event="password_reset_request",
@@ -1141,7 +1150,7 @@ async def password_reset(
     request: Request,
     db: AsyncSession = Depends(get_db),
 ):
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     result = await db.execute(select(User).where(User.username == body.username))
     user = result.scalar_one_or_none()
     if not user:
@@ -1157,7 +1166,7 @@ async def password_reset(
     if not verif:
         raise HTTPException(status_code=404,
                             detail="No pending reset for this account")
-    if verif.expires_at.replace(tzinfo=timezone.utc) < now:
+    if verif.expires_at.replace(tzinfo=UTC) < now:
         raise HTTPException(status_code=410, detail="Reset code expired")
     if verif.attempts >= VERIFICATION_MAX_ATTEMPTS:
         raise HTTPException(status_code=429, detail="Too many attempts")
diff --git a/packages/meshbay-hub/src/meshbay_hub/app.py b/packages/meshbay-hub/src/meshbay_hub/app.py
index afc1cde..209dc32 100644
--- a/packages/meshbay-hub/src/meshbay_hub/app.py
+++ b/packages/meshbay-hub/src/meshbay_hub/app.py
@@ -11,37 +11,41 @@ Usage:
 
 import asyncio
 from contextlib import asynccontextmanager
-from pathlib import Path
 
 from fastapi import FastAPI
 from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
 
 from meshbay_hub import __version__
+from meshbay_hub.api.admin import router as admin_router
+from meshbay_hub.api.deps import set_admin_usernames
+from meshbay_hub.api.federation import router as federation_router
+from meshbay_hub.api.groups import router as groups_router
+from meshbay_hub.api.groups import swarm_router
+from meshbay_hub.api.health import router as health_router
+from meshbay_hub.api.hub import router as hub_router
+from meshbay_hub.api.hub import set_config as hub_set_config
+from meshbay_hub.api.middleware import limiter
+from meshbay_hub.api.moderation import router as moderation_router
+from meshbay_hub.api.nodes import router as nodes_router
+from meshbay_hub.api.notifications import router as notifications_router
+from meshbay_hub.api.relay import router as relay_router
+from meshbay_hub.api.revocation import router as revocation_router
+from meshbay_hub.api.signaling import router as signaling_router
+from meshbay_hub.api.users import router as users_router
+from meshbay_hub.api.users import set_config as users_set_config
+from meshbay_hub.api.webapp import ASSET_V, CSP, STATIC_DIR
+from meshbay_hub.api.webapp import router as webapp_router
 from meshbay_hub.auth import generate_hub_keypair, load_hub_keypair
 from meshbay_hub.config import HubConfig
+from meshbay_hub.csam import csam_router
 from meshbay_hub.db.engine import close_db, init_db
-from meshbay_hub.api.hub        import router as hub_router, set_config as hub_set_config
-from meshbay_hub.api.users      import router as users_router, set_config as users_set_config
-from meshbay_hub.api.deps       import set_admin_usernames
-from meshbay_hub.api.nodes      import router as nodes_router
-from meshbay_hub.api.groups     import router as groups_router, swarm_router
-from meshbay_hub.api.revocation  import router as revocation_router
-from meshbay_hub.api.moderation  import router as moderation_router
-from meshbay_hub.api.federation  import router as federation_router
-from meshbay_hub.csam            import csam_router
-from meshbay_hub.api.health      import router as health_router
-from meshbay_hub.api.relay       import router as relay_router
-from meshbay_hub.api.signaling   import router as signaling_router
-from meshbay_hub.api.admin       import router as admin_router
-from meshbay_hub.api.notifications import router as notifications_router
-from meshbay_hub.api.webapp     import router as webapp_router, STATIC_DIR, ASSET_V, CSP
-from meshbay_hub.api.middleware import limiter
 
 
 async def _sync_admin_roles(admin_usernames: list[str]) -> None:
     """Ensure config-listed admin usernames have role='admin' in the DB."""
-    from sqlalchemy import select, update
+    from sqlalchemy import select
+
     from meshbay_hub.db.engine import get_session_factory
     from meshbay_hub.db.models import User
 
@@ -122,8 +126,8 @@ def create_app(cfg: HubConfig | None = None) -> FastAPI:
         from meshbay_hub.csam import get_csam_checker
         get_csam_checker().load()
 
-        from meshbay_hub.tasks.cleanup import cleanup_loop
         from meshbay_hub.db.engine import get_session_factory
+        from meshbay_hub.tasks.cleanup import cleanup_loop
         cleanup_task = asyncio.create_task(cleanup_loop(get_session_factory()))
 
         yield
diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py
index 7045197..d038027 100644
--- a/packages/meshbay-hub/src/meshbay_hub/auth.py
+++ b/packages/meshbay-hub/src/meshbay_hub/auth.py
@@ -18,12 +18,12 @@ from pathlib import Path
 
 import blake3
 import jwt
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from cryptography.hazmat.primitives.hashes import SHA256
 from cryptography.hazmat.primitives.kdf.argon2 import Argon2id
 from cryptography.hazmat.primitives.kdf.hkdf import HKDF
-from cryptography.hazmat.primitives.hashes import SHA256
 
 # Argon2id parameters — versioned for gradual migration
 _ARGON2_LANES   = 4
diff --git a/packages/meshbay-hub/src/meshbay_hub/csam.py b/packages/meshbay-hub/src/meshbay_hub/csam.py
index 2a0ce25..e540068 100644
--- a/packages/meshbay-hub/src/meshbay_hub/csam.py
+++ b/packages/meshbay-hub/src/meshbay_hub/csam.py
@@ -19,9 +19,7 @@ IMPORTANT: Never log matched hashes or file contents. CSAM detection
 must be reported to NCMEC (US law) or relevant authority immediately.
 """
 
-import hashlib
 import logging
-import os
 from pathlib import Path
 
 log = logging.getLogger(__name__)
@@ -123,7 +121,8 @@ def check_content_hash(blake3_hex: str) -> bool:
 
 # ── Hub API integration ───────────────────────────────────────────────────────
 
-from fastapi import APIRouter, Depends, HTTPException, UploadFile, File
+from fastapi import APIRouter, Depends, HTTPException
+
 from meshbay_hub.api.deps import require_admin
 from meshbay_hub.db.models import User
 
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/__init__.py b/packages/meshbay-hub/src/meshbay_hub/db/__init__.py
index 62e5388..9d7483a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/__init__.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/__init__.py
@@ -1,6 +1,6 @@
 """Hub database layer."""
-from .engine import init_db, close_db, get_db
-from .models import Base, User, Node, Group, GroupMember, RefreshToken, IPLog
+from .engine import close_db, get_db, init_db
+from .models import Base, Group, GroupMember, IPLog, Node, RefreshToken, User
 
 __all__ = [
     "init_db", "close_db", "get_db",
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/env.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/env.py
index 8908deb..61f80be 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/env.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/env.py
@@ -4,14 +4,12 @@ import asyncio
 import os
 from logging.config import fileConfig
 
+from alembic import context
+from meshbay_hub.db.models import Base
 from sqlalchemy import pool
 from sqlalchemy.engine import Connection
 from sqlalchemy.ext.asyncio import async_engine_from_config
 
-from alembic import context
-
-from meshbay_hub.db.models import Base
-
 config = context.config
 
 if config.config_file_name is not None:
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a7b8c9d0e1f2_add_group_last_activity.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a7b8c9d0e1f2_add_group_last_activity.py
index 8a4e2ee..034d12f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a7b8c9d0e1f2_add_group_last_activity.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a7b8c9d0e1f2_add_group_last_activity.py
@@ -5,16 +5,15 @@ Revises: f1a2b3c4d5e6
 Create Date: 2026-08-20 20:50:00.000000
 
 """
-from typing import Sequence, Union
+from collections.abc import Sequence
 
-from alembic import op
 import sqlalchemy as sa
-
+from alembic import op
 
 revision: str = 'a7b8c9d0e1f2'
-down_revision: Union[str, Sequence[str], None] = 'f1a2b3c4d5e6'
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
+down_revision: str | Sequence[str] | None = 'f1a2b3c4d5e6'
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
 
 
 def upgrade() -> None:
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a9b8c7d6e5f4_add_login_throttle.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a9b8c7d6e5f4_add_login_throttle.py
index 2fead6c..45985e2 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a9b8c7d6e5f4_add_login_throttle.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a9b8c7d6e5f4_add_login_throttle.py
@@ -7,15 +7,15 @@ Revision ID: a9b8c7d6e5f4
 Revises: e5f6a7b8c9d0
 """
 
-from typing import Sequence, Union
+from collections.abc import Sequence
 
 import sqlalchemy as sa
 from alembic import op
 
 revision: str = "a9b8c7d6e5f4"
-down_revision: Union[str, Sequence[str], None] = "e5f6a7b8c9d0"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
+down_revision: str | Sequence[str] | None = "e5f6a7b8c9d0"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
 
 
 def upgrade() -> None:
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/b1c2d3e4f5a6_add_hub_settings.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/b1c2d3e4f5a6_add_hub_settings.py
index 13f2b5c..9a90f7a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/b1c2d3e4f5a6_add_hub_settings.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/b1c2d3e4f5a6_add_hub_settings.py
@@ -5,16 +5,15 @@ Revises: a7b8c9d0e1f2
 Create Date: 2026-08-28 12:00:00.000000
 
 """
-from typing import Sequence, Union
+from collections.abc import Sequence
 
-from alembic import op
 import sqlalchemy as sa
-
+from alembic import op
 
 revision: str = 'b1c2d3e4f5a6'
-down_revision: Union[str, Sequence[str], None] = 'a7b8c9d0e1f2'
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
+down_revision: str | Sequence[str] | None = 'a7b8c9d0e1f2'
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
 
 
 def upgrade() -> None:
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/c3d4e5f6a7b8_group_name_unique_per_owner.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/c3d4e5f6a7b8_group_name_unique_per_owner.py
index 6fc5b73..fea0583 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/c3d4e5f6a7b8_group_name_unique_per_owner.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/c3d4e5f6a7b8_group_name_unique_per_owner.py
@@ -10,16 +10,15 @@ its UUID — this only makes `name@owner` a dependable handle.
 Pre-flight: abort if the data already violates it, with the offending
 (admin_id, name) pairs listed, rather than silently renaming anyone's group.
 """
-from typing import Sequence, Union
+from collections.abc import Sequence
 
-from alembic import op
 import sqlalchemy as sa
-
+from alembic import op
 
 revision: str = 'c3d4e5f6a7b8'
-down_revision: Union[str, Sequence[str], None] = 'b1c2d3e4f5a6'
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
+down_revision: str | Sequence[str] | None = 'b1c2d3e4f5a6'
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
 
 
 def upgrade() -> None:
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py
index 6301426..a814f37 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py
@@ -12,16 +12,15 @@ Revises:
 Create Date: 2026-08-09 04:35:07.120021
 
 """
-from typing import Sequence, Union
+from collections.abc import Sequence
 
-from alembic import op
 import sqlalchemy as sa
-
+from alembic import op
 
 revision: str = 'd28b9caf9f07'
-down_revision: Union[str, Sequence[str], None] = None
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
+down_revision: str | Sequence[str] | None = None
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
 
 
 def upgrade() -> None:
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d4e5f6a7b8c9_add_email_verification.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d4e5f6a7b8c9_add_email_verification.py
index 6741eb8..aa15b6d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d4e5f6a7b8c9_add_email_verification.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d4e5f6a7b8c9_add_email_verification.py
@@ -9,16 +9,15 @@ Revises: c3d4e5f6a7b8
 Create Date: 2026-08-31 14:00:00.000000
 
 """
-from typing import Sequence, Union
+from collections.abc import Sequence
 
-from alembic import op
 import sqlalchemy as sa
-
+from alembic import op
 
 revision: str = 'd4e5f6a7b8c9'
-down_revision: Union[str, Sequence[str], None] = 'c3d4e5f6a7b8'
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
+down_revision: str | Sequence[str] | None = 'c3d4e5f6a7b8'
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
 
 
 def upgrade() -> None:
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/e5f6a7b8c9d0_add_mail_quota.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/e5f6a7b8c9d0_add_mail_quota.py
index 8f2e4d2..c729de4 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/e5f6a7b8c9d0_add_mail_quota.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/e5f6a7b8c9d0_add_mail_quota.py
@@ -8,15 +8,15 @@ Revision ID: e5f6a7b8c9d0
 Revises: d4e5f6a7b8c9
 """
 
-from typing import Sequence, Union
+from collections.abc import Sequence
 
 import sqlalchemy as sa
 from alembic import op
 
 revision: str = "e5f6a7b8c9d0"
-down_revision: Union[str, Sequence[str], None] = "d4e5f6a7b8c9"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
+down_revision: str | Sequence[str] | None = "d4e5f6a7b8c9"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
 
 
 def upgrade() -> None:
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/f1a2b3c4d5e6_add_user_preferences.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/f1a2b3c4d5e6_add_user_preferences.py
index e30a4da..9f8e729 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/f1a2b3c4d5e6_add_user_preferences.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/f1a2b3c4d5e6_add_user_preferences.py
@@ -5,16 +5,15 @@ Revises: d28b9caf9f07
 Create Date: 2026-08-19 12:00:00.000000
 
 """
-from typing import Sequence, Union
+from collections.abc import Sequence
 
-from alembic import op
 import sqlalchemy as sa
-
+from alembic import op
 
 revision: str = 'f1a2b3c4d5e6'
-down_revision: Union[str, Sequence[str], None] = 'd28b9caf9f07'
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
+down_revision: str | Sequence[str] | None = 'd28b9caf9f07'
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
 
 
 def upgrade() -> None:
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py
index 62e4a11..38c4723 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/models.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py
@@ -11,17 +11,23 @@ Tables:
 """
 
 import uuid
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 from sqlalchemy import (
-    Boolean, DateTime, ForeignKey, Index, Integer,
-    String, Text, UniqueConstraint, text,
+    Boolean,
+    DateTime,
+    ForeignKey,
+    Index,
+    Integer,
+    String,
+    Text,
+    text,
 )
 from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column, relationship
 
 
 def _now() -> datetime:
-    return datetime.now(timezone.utc)
+    return datetime.now(UTC)
 
 def _uuid() -> str:
     return str(uuid.uuid4())
diff --git a/packages/meshbay-hub/src/meshbay_hub/login_throttle.py b/packages/meshbay-hub/src/meshbay_hub/login_throttle.py
index 3281088..bfd142e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/login_throttle.py
+++ b/packages/meshbay-hub/src/meshbay_hub/login_throttle.py
@@ -24,7 +24,7 @@ locks somebody else's name from signing them out (§13.5b, AV26).
 """
 
 import hashlib
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 
 from sqlalchemy import case, delete, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -39,7 +39,7 @@ def _key(username: str) -> str:
 
 def _aware(dt: datetime) -> datetime:
     # SQLite hands back naive datetimes for a timezone-aware column.
-    return dt if dt.tzinfo is not None else dt.replace(tzinfo=timezone.utc)
+    return dt if dt.tzinfo is not None else dt.replace(tzinfo=UTC)
 
 
 def _insert_for(db: AsyncSession):
@@ -64,7 +64,7 @@ async def reserve(db: AsyncSession, username: str) -> tuple[bool, int]:
     if max_failures == 0:
         return True, 0
 
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     window = timedelta(minutes=limits["lockout_minutes"])
     window_start = now - window
     key = _key(username)
@@ -102,7 +102,7 @@ async def locked_for(db: AsyncSession, username: str) -> int:
         return 0
     remaining = (_aware(row.last_failure_at)
                  + timedelta(minutes=limits["lockout_minutes"])
-                 - datetime.now(timezone.utc)).total_seconds()
+                 - datetime.now(UTC)).total_seconds()
     return max(0, int(remaining + 0.999))
 
 
@@ -136,7 +136,7 @@ async def clear(db: AsyncSession, username: str) -> None:
 async def purge_expired(db: AsyncSession) -> int:
     """Rows whose failures have aged out. Every unknown name typed creates one."""
     limits = await hub_settings.login_limits(db)
-    cutoff = datetime.now(timezone.utc) - timedelta(minutes=limits["lockout_minutes"])
+    cutoff = datetime.now(UTC) - timedelta(minutes=limits["lockout_minutes"])
     result = await db.execute(
         delete(LoginThrottle).where(LoginThrottle.last_failure_at < cutoff))
     await db.commit()
diff --git a/packages/meshbay-hub/src/meshbay_hub/mail.py b/packages/meshbay-hub/src/meshbay_hub/mail.py
index 126ed45..1eb7c51 100644
--- a/packages/meshbay-hub/src/meshbay_hub/mail.py
+++ b/packages/meshbay-hub/src/meshbay_hub/mail.py
@@ -16,7 +16,7 @@ import asyncio
 import hashlib
 import logging
 import smtplib
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from email.message import EmailMessage
 
 log = logging.getLogger(__name__)
@@ -79,7 +79,7 @@ async def _take(db, key: str, window: timedelta, ceiling: int,
     """
     from meshbay_hub.db.models import MailQuota
 
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     row = await db.get(MailQuota, key)
     if row is None:
         row = MailQuota(key=key, window_start=now, count=0, last_sent=None)
@@ -87,14 +87,14 @@ async def _take(db, key: str, window: timedelta, ceiling: int,
 
     started = row.window_start
     if started.tzinfo is None:
-        started = started.replace(tzinfo=timezone.utc)
+        started = started.replace(tzinfo=UTC)
     if now - started >= window:
         row.window_start, row.count = now, 0
 
     if cooldown is not None and row.last_sent is not None:
         last = row.last_sent
         if last.tzinfo is None:
-            last = last.replace(tzinfo=timezone.utc)
+            last = last.replace(tzinfo=UTC)
         if now - last < cooldown:
             raise MailRefused("too soon since the last message to this recipient")
 
@@ -131,12 +131,12 @@ async def _announce_exhaustion(scope: str) -> None:
     try:
         async with get_session_factory()() as db:
             key = f"alert:{scope}"
-            now = datetime.now(timezone.utc)
+            now = datetime.now(UTC)
             row = await db.get(MailQuota, key)
             if row is not None and row.last_sent is not None:
                 last = row.last_sent
                 if last.tzinfo is None:
-                    last = last.replace(tzinfo=timezone.utc)
+                    last = last.replace(tzinfo=UTC)
                 if now - last < timedelta(hours=1):
                     return
             if row is None:
@@ -202,9 +202,10 @@ async def reserve(db, purpose: str, address: str) -> None:
 
 async def status(db) -> dict:
     """What the operator sees in the panel: is the hub still sending?"""
+    from sqlalchemy import func, select
+
     from meshbay_hub import hub_settings
     from meshbay_hub.db.models import MailQuota
-    from sqlalchemy import func, select
 
     limits = await hub_settings.mail_limits(db)
     row = await db.get(MailQuota, "hour")
@@ -213,8 +214,8 @@ async def status(db) -> dict:
     if row is not None:
         started = row.window_start
         if started.tzinfo is None:
-            started = started.replace(tzinfo=timezone.utc)
-        if datetime.now(timezone.utc) - started < timedelta(hours=1):
+            started = started.replace(tzinfo=UTC)
+        if datetime.now(UTC) - started < timedelta(hours=1):
             used, window_start = row.count, started.isoformat()
 
     recipients = await db.scalar(
@@ -244,10 +245,11 @@ async def status(db) -> dict:
 
 async def purge_expired_quota(db) -> int:
     """Drop counters whose window has passed. Returns how many went."""
-    from meshbay_hub.db.models import MailQuota
     from sqlalchemy import delete
 
-    cutoff = datetime.now(timezone.utc) - timedelta(days=1)
+    from meshbay_hub.db.models import MailQuota
+
+    cutoff = datetime.now(UTC) - timedelta(days=1)
     result = await db.execute(
         delete(MailQuota).where(MailQuota.window_start < cutoff))
     await db.commit()
diff --git a/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py b/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py
index 5c52387..429575f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py
+++ b/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py
@@ -2,7 +2,7 @@
 
 import asyncio
 import logging
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 
 from sqlalchemy import delete, select
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -16,7 +16,7 @@ CLEANUP_INTERVAL_HOURS = 24
 
 
 async def purge_old_ip_logs(db: AsyncSession, retention_days: int = RETENTION_DAYS) -> int:
-    cutoff = datetime.now(timezone.utc) - timedelta(days=retention_days)
+    cutoff = datetime.now(UTC) - timedelta(days=retention_days)
     result = await db.execute(delete(IPLog).where(IPLog.timestamp < cutoff))
     await db.commit()
     return result.rowcount
@@ -26,7 +26,7 @@ PENDING_USER_EXPIRY_DAYS = 7
 
 
 async def purge_expired_verifications(db: AsyncSession) -> int:
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     result = await db.execute(
         delete(EmailVerification).where(EmailVerification.expires_at < now))
     await db.commit()
@@ -35,7 +35,7 @@ async def purge_expired_verifications(db: AsyncSession) -> int:
 
 async def purge_stale_pending_users(db: AsyncSession,
                                      expiry_days: int = PENDING_USER_EXPIRY_DAYS) -> int:
-    cutoff = datetime.now(timezone.utc) - timedelta(days=expiry_days)
+    cutoff = datetime.now(UTC) - timedelta(days=expiry_days)
     result = await db.execute(
         delete(User).where(User.status == "pending", User.created_at < cutoff))
     await db.commit()
@@ -93,7 +93,7 @@ async def find_unhosted_groups(db: AsyncSession, grace_days: int = UNHOSTED_GRAC
     whole reason the column exists rather than a check against the live socket
     registry, which would delete every group during a hub restart.
     """
-    cutoff = datetime.now(timezone.utc) - timedelta(days=grace_days)
+    cutoff = datetime.now(UTC) - timedelta(days=grace_days)
     result = await db.execute(
         select(Group).where(Group.hosted_at.is_(None), Group.created_at < cutoff))
     return list(result.scalars().all())
diff --git a/packages/meshbay-hub/tests/conftest.py b/packages/meshbay-hub/tests/conftest.py
index bf94464..bb0ed28 100644
--- a/packages/meshbay-hub/tests/conftest.py
+++ b/packages/meshbay-hub/tests/conftest.py
@@ -1,12 +1,12 @@
 """Shared pytest fixtures for hub tests."""
 
 import os
+from pathlib import Path
+
 import pytest
 import pytest_asyncio
-from pathlib import Path
-from unittest.mock import AsyncMock
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 
 # Force SQLite in-memory for all hub tests
 os.environ.setdefault("MESHBAY_DATABASE_URL", "sqlite+aiosqlite:///:memory:")
@@ -28,7 +28,13 @@ def hub_key_path(tmp_path_factory) -> Path:
 
 @pytest.fixture
 def hub_config(hub_key_path, tmp_path):
-    from meshbay_hub.config import HubConfig, DatabaseConfig, ServerConfig, HubIdentityConfig, JWTConfig
+    from meshbay_hub.config import (
+        DatabaseConfig,
+        HubConfig,
+        HubIdentityConfig,
+        JWTConfig,
+        ServerConfig,
+    )
     cfg = HubConfig(
         db=DatabaseConfig(url="sqlite+aiosqlite:///:memory:"),
         server=ServerConfig(host="127.0.0.1", port=8000),
diff --git a/packages/meshbay-hub/tests/harness/chat_send_probe.py b/packages/meshbay-hub/tests/harness/chat_send_probe.py
index b6dd957..d343c50 100644
--- a/packages/meshbay-hub/tests/harness/chat_send_probe.py
+++ b/packages/meshbay-hub/tests/harness/chat_send_probe.py
@@ -96,7 +96,6 @@ def _page() -> str:
     the page built itself would prove only that the page agrees with the page.
     """
     import msgpack  # noqa: F401  (imported for the failure it gives if absent)
-
     from meshbay_common.groupbox import PURPOSE_CHAT_KEYS, seal
 
     sealed = seal(GEK, PURPOSE_CHAT_KEYS, "chat_keys_resp", GROUP_ID,
diff --git a/packages/meshbay-hub/tests/test_account_deletion.py b/packages/meshbay-hub/tests/test_account_deletion.py
index 3d3fee4..2653f0d 100644
--- a/packages/meshbay-hub/tests/test_account_deletion.py
+++ b/packages/meshbay-hub/tests/test_account_deletion.py
@@ -12,9 +12,8 @@ command.
 import hashlib
 
 import pytest
-from sqlalchemy import select
-
 from meshbay_hub.db.models import GroupMember, Notification, RefreshToken, User
+from sqlalchemy import select
 
 
 def _auth_key(password: str, username: str) -> str:
diff --git a/packages/meshbay-hub/tests/test_account_pinning.py b/packages/meshbay-hub/tests/test_account_pinning.py
index 192bd25..a1419c3 100644
--- a/packages/meshbay-hub/tests/test_account_pinning.py
+++ b/packages/meshbay-hub/tests/test_account_pinning.py
@@ -23,7 +23,6 @@ from pathlib import Path
 import pytest
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-
 from meshbay_common.device import device_add_transcript
 
 STATIC = (Path(__file__).resolve().parents[1]
diff --git a/packages/meshbay-hub/tests/test_admin_views.py b/packages/meshbay-hub/tests/test_admin_views.py
index 5017b76..da2d3c9 100644
--- a/packages/meshbay-hub/tests/test_admin_views.py
+++ b/packages/meshbay-hub/tests/test_admin_views.py
@@ -11,9 +11,8 @@ import base64
 import hashlib
 
 import pytest
-from sqlalchemy import select
-
 from meshbay_hub.db.models import User
+from sqlalchemy import select
 
 
 def _auth_key(password: str, username: str) -> str:
@@ -109,9 +108,8 @@ async def test_a_node_is_recorded_at_the_address_it_announced_from(
     import base64
     import time
 
-    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
     from cryptography.hazmat.primitives import serialization
-
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
     from meshbay_hub.db.models import Node
 
     admin = await _admin(client, db_session, "root4_test")
diff --git a/packages/meshbay-hub/tests/test_asset_versioning.py b/packages/meshbay-hub/tests/test_asset_versioning.py
index 0c93f5a..aa2dc6d 100644
--- a/packages/meshbay-hub/tests/test_asset_versioning.py
+++ b/packages/meshbay-hub/tests/test_asset_versioning.py
@@ -22,7 +22,6 @@ import re
 
 import pytest
 from fastapi.testclient import TestClient
-
 from meshbay_hub.api.webapp import ASSET_V, STATIC_DIR, _asset_version
 from meshbay_hub.app import create_app
 
diff --git a/packages/meshbay-hub/tests/test_availability_between_members.py b/packages/meshbay-hub/tests/test_availability_between_members.py
index 2be7c03..4f5cbfb 100644
--- a/packages/meshbay-hub/tests/test_availability_between_members.py
+++ b/packages/meshbay-hub/tests/test_availability_between_members.py
@@ -24,7 +24,6 @@ import time
 import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
-
 from meshbay_common.crypto import pk_to_b64
 
 
@@ -158,8 +157,7 @@ async def test_one_node_cannot_spend_the_hubs_database_on_notifications():
     without backpressure. The budget is what stops one group's node from
     costing every other group on the instance.
     """
-    from meshbay_hub.api.revocation import (
-        NOTIFY_BURST, _notify_budget, _notify_window)
+    from meshbay_hub.api.revocation import NOTIFY_BURST, _notify_budget, _notify_window
 
     node = "budget-node"
     _notify_window.pop(node, None)
@@ -265,8 +263,7 @@ def test_a_node_cannot_answer_an_offer_it_was_never_sent():
     """
     import asyncio
 
-    from meshbay_hub.api.signaling import (
-        _answer_owner, _webrtc_answers, handle_webrtc_answer)
+    from meshbay_hub.api.signaling import _answer_owner, _webrtc_answers, handle_webrtc_answer
 
     loop = asyncio.new_event_loop()
     try:
@@ -657,6 +654,7 @@ async def test_a_member_still_reaches_the_node_they_share_a_group_with(client):
     class _AnsweringWS:
         async def send_text(self, text):
             import json as _json
+
             from meshbay_hub.api.signaling import handle_webrtc_answer
             msg = _json.loads(text)
             answered.append(msg)
diff --git a/packages/meshbay-hub/tests/test_captcha_host_check.py b/packages/meshbay-hub/tests/test_captcha_host_check.py
index 68cad34..778009f 100644
--- a/packages/meshbay-hub/tests/test_captcha_host_check.py
+++ b/packages/meshbay-hub/tests/test_captcha_host_check.py
@@ -31,12 +31,10 @@ TOML list is a typo far more often than an intention.
 import json
 
 import pytest
-
 from meshbay_hub.captcha import verify_captcha
 from meshbay_hub.config import CaptchaConfig, load_config
 
 
-
 class _Resp:
     def __init__(self, payload):
         self._payload = payload
diff --git a/packages/meshbay-hub/tests/test_device_auth.py b/packages/meshbay-hub/tests/test_device_auth.py
index e899f12..f9b172e 100644
--- a/packages/meshbay-hub/tests/test_device_auth.py
+++ b/packages/meshbay-hub/tests/test_device_auth.py
@@ -21,9 +21,7 @@ stopped being true.
 import base64
 import time
 
-import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-
 from meshbay_common.crypto import pk_to_b64
 
 
diff --git a/packages/meshbay-hub/tests/test_group_hosting.py b/packages/meshbay-hub/tests/test_group_hosting.py
index c571771..c6111f2 100644
--- a/packages/meshbay-hub/tests/test_group_hosting.py
+++ b/packages/meshbay-hub/tests/test_group_hosting.py
@@ -14,13 +14,12 @@ deleted every group during a hub restart.
 
 import base64
 import hashlib
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 
 import pytest
-from sqlalchemy import select
-
 from meshbay_hub.db.models import Group, GroupMember
 from meshbay_hub.tasks.cleanup import find_unhosted_groups, prune_unhosted_groups
+from sqlalchemy import select
 
 
 def _auth_key(password: str, username: str) -> str:
@@ -49,7 +48,7 @@ async def _group(client, owner, name, visibility="private", join_policy=None):
 
 async def _mark_hosted(db_session, group_id, when=None):
     g = await db_session.get(Group, group_id)
-    g.hosted_at = when or datetime.now(timezone.utc)
+    g.hosted_at = when or datetime.now(UTC)
     await db_session.commit()
 
 
@@ -134,7 +133,7 @@ async def test_an_unhosted_group_past_the_grace_period_is_collected(client, db_s
     gid = (await _group(client, owner, "abandoned")).json()["group_id"]
 
     g = await db_session.get(Group, gid)
-    g.created_at = datetime.now(timezone.utc) - timedelta(days=8)
+    g.created_at = datetime.now(UTC) - timedelta(days=8)
     await db_session.commit()
 
     gone = await prune_unhosted_groups(db_session)
@@ -149,8 +148,8 @@ async def test_an_old_group_that_was_hosted_is_never_collected(client, db_sessio
     gid = (await _group(client, owner, "long-lived")).json()["group_id"]
 
     g = await db_session.get(Group, gid)
-    g.created_at = datetime.now(timezone.utc) - timedelta(days=400)
-    g.hosted_at = datetime.now(timezone.utc) - timedelta(days=399)
+    g.created_at = datetime.now(UTC) - timedelta(days=400)
+    g.hosted_at = datetime.now(UTC) - timedelta(days=399)
     await db_session.commit()
 
     assert await find_unhosted_groups(db_session) == []
@@ -161,7 +160,7 @@ async def test_dry_run_reports_without_deleting(client, db_session):
     owner = await _user(client, "reaper4_test")
     gid = (await _group(client, owner, "still-here")).json()["group_id"]
     g = await db_session.get(Group, gid)
-    g.created_at = datetime.now(timezone.utc) - timedelta(days=30)
+    g.created_at = datetime.now(UTC) - timedelta(days=30)
     await db_session.commit()
 
     gone = await prune_unhosted_groups(db_session, dry_run=True)
@@ -178,7 +177,7 @@ async def test_collecting_a_group_takes_its_memberships_with_it(client, db_sessi
     await client.post(f"/v1/groups/{gid}/members/tagalong", json={}, headers=owner)
 
     g = await db_session.get(Group, gid)
-    g.created_at = datetime.now(timezone.utc) - timedelta(days=9)
+    g.created_at = datetime.now(UTC) - timedelta(days=9)
     await db_session.commit()
 
     await prune_unhosted_groups(db_session)
@@ -247,7 +246,7 @@ async def test_the_stamp_is_not_moved_by_a_later_reconnection(client, db_session
 
     owner = await _user(client, "stamped2")
     gid = (await _group(client, owner, "steady")).json()["group_id"]
-    first = datetime.now(timezone.utc) - timedelta(days=30)
+    first = datetime.now(UTC) - timedelta(days=30)
     await _mark_hosted([gid])
     g = await db_session.get(Group, gid)
     g.hosted_at = first
@@ -259,7 +258,7 @@ async def test_the_stamp_is_not_moved_by_a_later_reconnection(client, db_session
     await db_session.refresh(g)
     # SQLite hands back a naive datetime where PostgreSQL keeps the offset, so
     # the comparison is made on common ground rather than on the driver.
-    stored = g.hosted_at.replace(tzinfo=timezone.utc) if g.hosted_at.tzinfo is None \
+    stored = g.hosted_at.replace(tzinfo=UTC) if g.hosted_at.tzinfo is None \
         else g.hosted_at
     assert abs((stored - first).total_seconds()) < 1, "the stamp moved"
 
diff --git a/packages/meshbay-hub/tests/test_group_leave_and_quota.py b/packages/meshbay-hub/tests/test_group_leave_and_quota.py
index 4431f53..8af830d 100644
--- a/packages/meshbay-hub/tests/test_group_leave_and_quota.py
+++ b/packages/meshbay-hub/tests/test_group_leave_and_quota.py
@@ -14,13 +14,12 @@ removes them, and whoever left still holds the group key they were served.
 
 import base64
 import hashlib
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 import pytest
-from sqlalchemy import select
-
 from meshbay_hub.api.groups import MAX_PUBLIC_GROUPS
 from meshbay_hub.db.models import Group, GroupMember, User
+from sqlalchemy import select
 
 
 def _auth_key(password: str, username: str) -> str:
@@ -61,7 +60,7 @@ async def test_a_member_can_leave(client, db_session):
     # Marked hosted, or the member would not see the group in the first place
     # and the assertion below would hold whether or not leaving worked.
     g = await db_session.get(Group, gid)
-    g.hosted_at = datetime.now(timezone.utc)
+    g.hosted_at = datetime.now(UTC)
     await db_session.commit()
 
     before = await client.get("/v1/groups/mine", headers=member)
diff --git a/packages/meshbay-hub/tests/test_group_membership.py b/packages/meshbay-hub/tests/test_group_membership.py
index 2761595..ad1b3ab 100644
--- a/packages/meshbay-hub/tests/test_group_membership.py
+++ b/packages/meshbay-hub/tests/test_group_membership.py
@@ -11,10 +11,9 @@ import base64
 import hashlib
 
 import pytest
+from meshbay_hub.db.models import GroupMember, User
 from sqlalchemy import select
 
-from meshbay_hub.db.models import Group, GroupMember, User
-
 
 def _auth_key(password: str, username: str) -> str:
     salt = hashlib.sha256(f"meshbay:auth:v1:{username}".encode()).digest()
diff --git a/packages/meshbay-hub/tests/test_group_purge.py b/packages/meshbay-hub/tests/test_group_purge.py
index 0611dba..e729297 100644
--- a/packages/meshbay-hub/tests/test_group_purge.py
+++ b/packages/meshbay-hub/tests/test_group_purge.py
@@ -21,13 +21,18 @@ from datetime import UTC, datetime, timedelta
 
 import jwt
 import pytest
-from sqlalchemy import delete, func, select, text
-from sqlalchemy.exc import IntegrityError
-
 from meshbay_hub.db.models import (
-    ContentReport, EmailVerification, Group, GroupMember, IPLog, Notification, User,
+    ContentReport,
+    EmailVerification,
+    Group,
+    GroupMember,
+    IPLog,
+    Notification,
+    User,
 )
 from meshbay_hub.db.purge import _referencing
+from sqlalchemy import delete, func, select, text
+from sqlalchemy.exc import IntegrityError
 
 SEEDED = {"group_members", "notifications", "email_verifications", "content_reports"}
 
diff --git a/packages/meshbay-hub/tests/test_groups_self_service.py b/packages/meshbay-hub/tests/test_groups_self_service.py
index f9346c1..a3a8f2d 100644
--- a/packages/meshbay-hub/tests/test_groups_self_service.py
+++ b/packages/meshbay-hub/tests/test_groups_self_service.py
@@ -1,9 +1,10 @@
 """Integration tests for group self-service: create, join, members."""
 
+from datetime import UTC
+
 import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
-
 from meshbay_common.crypto import pk_to_b64
 
 
@@ -43,10 +44,11 @@ async def _create_group(client, token, name="test-group", visibility="public",
 
 async def _mark_hosted(db_session, *group_ids):
     """Pretend a node announced these groups, as /v1/nodes/ws would."""
-    from datetime import datetime, timezone
+    from datetime import datetime
+
     from meshbay_hub.db.models import Group
     for gid in group_ids:
-        (await db_session.get(Group, gid)).hosted_at = datetime.now(timezone.utc)
+        (await db_session.get(Group, gid)).hosted_at = datetime.now(UTC)
     await db_session.commit()
 
 
diff --git a/packages/meshbay-hub/tests/test_hub_api.py b/packages/meshbay-hub/tests/test_hub_api.py
index 37e8e4f..9b73701 100644
--- a/packages/meshbay-hub/tests/test_hub_api.py
+++ b/packages/meshbay-hub/tests/test_hub_api.py
@@ -3,13 +3,11 @@ Integration tests for the Hub API.
 Uses SQLite in-memory + httpx.AsyncClient — no PostgreSQL, no network.
 """
 
-import base64
+from datetime import UTC
+
 import pytest
-import pytest_asyncio
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
-from cryptography.hazmat.primitives import serialization
-
 from meshbay_common.crypto import pk_to_b64
 from meshbay_hub.api.deps import set_admin_usernames
 
@@ -32,7 +30,8 @@ async def _announce_signed(client, token: str) -> tuple[str, str]:
     The node key is independent of the user's identity key, so this mints a fresh
     one and signs the domain-separated announce message with it.
     """
-    import base64 as _b64, time as _t
+    import base64 as _b64
+    import time as _t
 
     me = await client.get("/v1/users/me",
                           headers={"Authorization": f"Bearer {token}"})
@@ -399,9 +398,10 @@ async def test_my_groups(client, db_session):
     # A group no node has announced is shown to its owner only — a member would
     # otherwise see a name they cannot open. Stamped here so the rest of this
     # test is about membership, which is what it was written for.
-    from datetime import datetime, timezone
+    from datetime import datetime
+
     from meshbay_hub.db.models import Group
-    (await db_session.get(Group, group_id)).hosted_at = datetime.now(timezone.utc)
+    (await db_session.get(Group, group_id)).hosted_at = datetime.now(UTC)
     await db_session.commit()
 
     # Re-login to get fresh token with group claims
@@ -434,7 +434,6 @@ async def test_my_groups(client, db_session):
 @pytest.mark.asyncio
 async def test_group_online_nodes(client):
     """GET /v1/groups/{id}/nodes returns online nodes serving the group."""
-    import json
     from meshbay_hub.api.revocation import _connected_nodes, _node_groups
 
     pk_ed, pk_x, _ = _gen_user_keys()
@@ -541,7 +540,7 @@ async def test_admin_can_revoke(client):
 @pytest.mark.asyncio
 async def test_email_encrypted_at_rest(client):
     """Email stored in DB must not contain plaintext address."""
-    from meshbay_hub.auth import encrypt_email, decrypt_email
+    from meshbay_hub.auth import decrypt_email, encrypt_email
     encrypted = encrypt_email("test@example.com")
     assert "@" not in encrypted
     assert decrypt_email(encrypted) == "test@example.com"
@@ -589,9 +588,10 @@ async def test_password_rehash_on_login(client, app):
         user = result.scalar_one()
         user.pw_version = 1
         # Re-hash with v1 params so verify_password(version=1) succeeds
-        from meshbay_hub.auth import _ARGON2_VERSIONS, _ARGON2_KEY_LEN, _ARGON2_LANES
-        from cryptography.hazmat.primitives.kdf.argon2 import Argon2id
         import os
+
+        from cryptography.hazmat.primitives.kdf.argon2 import Argon2id
+        from meshbay_hub.auth import _ARGON2_KEY_LEN, _ARGON2_LANES, _ARGON2_VERSIONS
         salt = os.urandom(16)
         params = _ARGON2_VERSIONS[1]
         pw_hash = Argon2id(
@@ -760,13 +760,14 @@ async def test_webrtc_signaling_roundtrip(client, app):
 @pytest.mark.asyncio
 async def test_ip_log_cleanup(app):
     """Old IP log entries are purged by cleanup task."""
-    from datetime import datetime, timezone, timedelta
+    from datetime import datetime, timedelta
+
     from meshbay_hub.db.engine import get_db
     from meshbay_hub.db.models import IPLog
     from meshbay_hub.tasks.cleanup import purge_old_ip_logs
 
     async for db in get_db():
-        old_ts = datetime.now(timezone.utc) - timedelta(days=400)
+        old_ts = datetime.now(UTC) - timedelta(days=400)
         db.add(IPLog(event="test_old", ip_address="1.2.3.4", timestamp=old_ts))
         db.add(IPLog(event="test_recent", ip_address="5.6.7.8"))
         await db.commit()
@@ -774,7 +775,7 @@ async def test_ip_log_cleanup(app):
         deleted = await purge_old_ip_logs(db, retention_days=365)
         assert deleted == 1
 
-        from sqlalchemy import select, func
+        from sqlalchemy import func, select
         count = (await db.execute(
             select(func.count()).where(IPLog.event.in_(["test_old", "test_recent"]))
         )).scalar_one()
diff --git a/packages/meshbay-hub/tests/test_login_lockout.py b/packages/meshbay-hub/tests/test_login_lockout.py
index 6f17d98..601edbd 100644
--- a/packages/meshbay-hub/tests/test_login_lockout.py
+++ b/packages/meshbay-hub/tests/test_login_lockout.py
@@ -18,14 +18,13 @@ is `test_availability_between_members.py`, because it takes two accounts.
 """
 
 import asyncio
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 
 import pytest
-from sqlalchemy import select, update
-
 from meshbay_hub.api.deps import set_admin_usernames
 from meshbay_hub.db.models import LoginThrottle
 from meshbay_hub.login_throttle import _key
+from sqlalchemy import select, update
 
 RIGHT = "r" * 44
 WRONG = "w" * 44
@@ -94,7 +93,7 @@ async def test_a_lockout_ends_when_its_window_does(client, db_session):
 
     await db_session.execute(
         update(LoginThrottle).where(LoginThrottle.key == _key("dave_test"))
-        .values(last_failure_at=datetime.now(timezone.utc) - timedelta(minutes=61)))
+        .values(last_failure_at=datetime.now(UTC) - timedelta(minutes=61)))
     await db_session.commit()
 
     assert (await _login(client, "dave_test", RIGHT)).status_code == 200
@@ -106,7 +105,7 @@ async def test_old_failures_do_not_carry_into_a_new_window(client, db_session):
     await _fail(client, "erin_test", 3)
     await db_session.execute(
         update(LoginThrottle).where(LoginThrottle.key == _key("erin_test"))
-        .values(last_failure_at=datetime.now(timezone.utc) - timedelta(minutes=61)))
+        .values(last_failure_at=datetime.now(UTC) - timedelta(minutes=61)))
     await db_session.commit()
 
     # One stale window of three, then one fresh failure: a count of one, not four.
diff --git a/packages/meshbay-hub/tests/test_mail_is_not_a_relay.py b/packages/meshbay-hub/tests/test_mail_is_not_a_relay.py
index fe6a5ee..a3f9a21 100644
--- a/packages/meshbay-hub/tests/test_mail_is_not_a_relay.py
+++ b/packages/meshbay-hub/tests/test_mail_is_not_a_relay.py
@@ -28,7 +28,6 @@ import base64
 import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
-
 from meshbay_common.crypto import pk_to_b64
 from meshbay_hub import mail as mail_mod
 from meshbay_hub.api import users as users_mod
@@ -316,9 +315,8 @@ async def _signed_in(client, db_session, username: str, email: str) -> dict:
     genuinely `pending` here, exactly as it would be in production, and a
     pending account cannot log in.
     """
-    from sqlalchemy import select, update
-
     from meshbay_hub.db.models import User
+    from sqlalchemy import select, update
 
     r = await _register(client, username, email)
     assert r.status_code == 201, r.text
@@ -406,9 +404,8 @@ async def test_the_delay_survives_the_verification_row_being_deleted(
                            json={"email": "c-first@example.test"})
     assert r.status_code == 200, r.text
 
-    from sqlalchemy import delete
-
     from meshbay_hub.db.models import EmailVerification
+    from sqlalchemy import delete
     await db_session.execute(delete(EmailVerification))
     await db_session.commit()
 
@@ -421,9 +418,8 @@ async def test_the_delay_survives_the_verification_row_being_deleted(
 # ── The operator's controls ──────────────────────────────────────────────────
 
 async def _admin(client, db_session, username: str) -> dict:
-    from sqlalchemy import update
-
     from meshbay_hub.db.models import User
+    from sqlalchemy import update
 
     headers = await _signed_in(client, db_session, username,
                                f"{username}@example.test")
@@ -491,9 +487,8 @@ async def test_an_unknown_mail_setting_is_refused(client, db_session):
 @pytest.mark.asyncio
 async def test_a_moderator_may_read_the_bounds_but_not_change_them(
         client, db_session):
-    from sqlalchemy import update
-
     from meshbay_hub.db.models import User
+    from sqlalchemy import update
 
     headers = await _signed_in(client, db_session, "mailmod_test",
                                "mailmod@example.test")
diff --git a/packages/meshbay-hub/tests/test_migrations_reach_head.py b/packages/meshbay-hub/tests/test_migrations_reach_head.py
index 13c5590..7f0d5df 100644
--- a/packages/meshbay-hub/tests/test_migrations_reach_head.py
+++ b/packages/meshbay-hub/tests/test_migrations_reach_head.py
@@ -30,9 +30,8 @@ from pathlib import Path
 import pytest
 from alembic import command
 from alembic.config import Config
-from sqlalchemy import create_engine, inspect
-
 from meshbay_hub.db.models import Base
+from sqlalchemy import create_engine, inspect
 
 HUB = Path(__file__).resolve().parents[1]
 
diff --git a/packages/meshbay-hub/tests/test_node_auth.py b/packages/meshbay-hub/tests/test_node_auth.py
index 4137932..09816de 100644
--- a/packages/meshbay-hub/tests/test_node_auth.py
+++ b/packages/meshbay-hub/tests/test_node_auth.py
@@ -8,9 +8,9 @@ import base64
 import time
 
 import pytest
+from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
-from cryptography.hazmat.primitives import serialization
 
 
 def _gen_ed25519():
diff --git a/packages/meshbay-hub/tests/test_node_ws_auth.py b/packages/meshbay-hub/tests/test_node_ws_auth.py
index f3ac3a2..7d96851 100644
--- a/packages/meshbay-hub/tests/test_node_ws_auth.py
+++ b/packages/meshbay-hub/tests/test_node_ws_auth.py
@@ -16,7 +16,6 @@ import base64
 import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
-
 from meshbay_common.crypto import pk_to_b64
 
 
@@ -405,7 +404,10 @@ async def test_empty_node_cannot_shadow_another_members_group(client):
     source for that group, because it is the one clients would reach first.
     """
     from meshbay_hub.api.revocation import (
-        _authorize_node_ws, _node_groups, get_online_nodes_for_group)
+        _authorize_node_ws,
+        _node_groups,
+        get_online_nodes_for_group,
+    )
 
     host = await _make_user(client, "hoster_test")
     guest = await _make_user(client, "guest_test")
diff --git a/packages/meshbay-hub/tests/test_notification_dismissal.py b/packages/meshbay-hub/tests/test_notification_dismissal.py
index 1c9c7b3..d498b4d 100644
--- a/packages/meshbay-hub/tests/test_notification_dismissal.py
+++ b/packages/meshbay-hub/tests/test_notification_dismissal.py
@@ -32,7 +32,6 @@ from pathlib import Path
 import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
-
 from meshbay_common.crypto import pk_to_b64
 from meshbay_hub.api.deps import set_admin_usernames
 
diff --git a/packages/meshbay-hub/tests/test_notifications.py b/packages/meshbay-hub/tests/test_notifications.py
index 02aca1c..b87e1d5 100644
--- a/packages/meshbay-hub/tests/test_notifications.py
+++ b/packages/meshbay-hub/tests/test_notifications.py
@@ -3,7 +3,6 @@
 import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
-
 from meshbay_common.crypto import pk_to_b64
 from meshbay_hub.api.deps import set_admin_usernames
 
diff --git a/packages/meshbay-hub/tests/test_notifications_behaviour.py b/packages/meshbay-hub/tests/test_notifications_behaviour.py
index a247508..67fd99e 100644
--- a/packages/meshbay-hub/tests/test_notifications_behaviour.py
+++ b/packages/meshbay-hub/tests/test_notifications_behaviour.py
@@ -7,13 +7,12 @@ browser's localStorage and nothing read it), and there was no way to clear the
 list.
 """
 
-import hashlib
 import base64
+import hashlib
 
 import pytest
-from sqlalchemy import select
-
 from meshbay_hub.db.models import GroupMember, Notification, User
+from sqlalchemy import select
 
 
 def _auth_key(password: str, username: str) -> str:
diff --git a/packages/meshbay-hub/tests/test_packaging_hub_unit.py b/packages/meshbay-hub/tests/test_packaging_hub_unit.py
index 7d8f5d2..e29164e 100644
--- a/packages/meshbay-hub/tests/test_packaging_hub_unit.py
+++ b/packages/meshbay-hub/tests/test_packaging_hub_unit.py
@@ -85,7 +85,6 @@ def test_the_command_resolves_from_the_installed_package_not_the_checkout():
     """Derived from `meshbay_hub.__file__`, so it is correct in a venv, an RPM
     and a checkout alike — which is the whole point of not writing it down."""
     import meshbay_hub
-
     from meshbay_hub.daemon import migrations_dir
 
     assert migrations_dir() == (
diff --git a/packages/meshbay-hub/tests/test_password_change.py b/packages/meshbay-hub/tests/test_password_change.py
index b2fe586..bfe0c97 100644
--- a/packages/meshbay-hub/tests/test_password_change.py
+++ b/packages/meshbay-hub/tests/test_password_change.py
@@ -11,9 +11,8 @@ import base64
 import hashlib
 
 import pytest
-from sqlalchemy import select
-
 from meshbay_hub.db.models import IPLog, RefreshToken, User
+from sqlalchemy import select
 
 
 def _auth_key(password: str, username: str) -> str:
diff --git a/packages/meshbay-hub/tests/test_password_reset.py b/packages/meshbay-hub/tests/test_password_reset.py
index 823807c..b07f77c 100644
--- a/packages/meshbay-hub/tests/test_password_reset.py
+++ b/packages/meshbay-hub/tests/test_password_reset.py
@@ -9,7 +9,7 @@ the recovery key and is not exercised here.
 
 import base64
 import time
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 
 import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
@@ -126,7 +126,7 @@ async def test_an_expired_code_is_refused(client, db_session):
         select(User.id).where(User.username == "carol_test"))).scalar_one()
     row = (await db_session.execute(select(EmailVerification).where(
         EmailVerification.user_id == uid))).scalars().one()
-    row.expires_at = datetime.now(timezone.utc) - timedelta(minutes=1)
+    row.expires_at = datetime.now(UTC) - timedelta(minutes=1)
     await db_session.commit()
 
     r = await client.post("/v1/users/password/reset", json={
diff --git a/packages/meshbay-hub/tests/test_public_groups_toggle.py b/packages/meshbay-hub/tests/test_public_groups_toggle.py
index 96e3383..dbc6a38 100644
--- a/packages/meshbay-hub/tests/test_public_groups_toggle.py
+++ b/packages/meshbay-hub/tests/test_public_groups_toggle.py
@@ -17,7 +17,7 @@ and their access — plan A, not a purge.
 
 import base64
 import hashlib
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 import pytest
 from meshbay_hub.api.deps import set_admin_usernames
@@ -61,7 +61,7 @@ async def _create_public(client, owner, name):
 async def _mark_hosted(db_session, *group_ids):
     """Pretend a node announced these groups, as /v1/nodes/ws would."""
     for gid in group_ids:
-        (await db_session.get(Group, gid)).hosted_at = datetime.now(timezone.utc)
+        (await db_session.get(Group, gid)).hosted_at = datetime.now(UTC)
     await db_session.commit()
 
 
diff --git a/packages/meshbay-hub/tests/test_revocation.py b/packages/meshbay-hub/tests/test_revocation.py
index ad9caf4..e2ca5e7 100644
--- a/packages/meshbay-hub/tests/test_revocation.py
+++ b/packages/meshbay-hub/tests/test_revocation.py
@@ -1,11 +1,9 @@
 """Tests for revocation — admin endpoint + token signing."""
 
-import time
-import pytest
 import jwt
+import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
-
 from meshbay_common.crypto import pk_to_b64
 from meshbay_hub.api.deps import set_admin_usernames
 
diff --git a/packages/meshbay-hub/tests/test_session_lifetime.py b/packages/meshbay-hub/tests/test_session_lifetime.py
index af73767..3a1f47a 100644
--- a/packages/meshbay-hub/tests/test_session_lifetime.py
+++ b/packages/meshbay-hub/tests/test_session_lifetime.py
@@ -6,13 +6,12 @@ maximum — plus a sign-out the hub honours and "sign out everywhere". The
 browser half is `test_browser_idle_signout.py`; this is the hub's.
 """
 
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 
 import pytest
-from sqlalchemy import select, update
-
 from meshbay_hub.api.deps import set_admin_usernames
 from meshbay_hub.db.models import RefreshToken, User
+from sqlalchemy import select, update
 
 AUTH_KEY = "s" * 44
 
@@ -40,7 +39,7 @@ async def _refresh(client, token):
 
 
 def _aware(dt):
-    return dt if dt.tzinfo else dt.replace(tzinfo=timezone.utc)
+    return dt if dt.tzinfo else dt.replace(tzinfo=UTC)
 
 
 async def _expiry(db_session, username):
@@ -66,7 +65,7 @@ async def test_the_defaults_are_in_the_panel_and_the_browser_delay_is_public(cli
 async def test_a_refresh_token_lasts_the_idle_window(client, db_session):
     await _register(client, "idle_window")
     await _login(client, "idle_window")
-    left = await _expiry(db_session, "idle_window") - datetime.now(timezone.utc)
+    left = await _expiry(db_session, "idle_window") - datetime.now(UTC)
     assert timedelta(hours=23, minutes=58) < left <= timedelta(hours=24)
 
 
@@ -78,7 +77,7 @@ async def test_the_idle_window_never_undercuts_the_access_token(client, db_sessi
                        json={"session": {"refresh_idle_hours": 1}})
     await _register(client, "short_idle")
     await _login(client, "short_idle")
-    left = await _expiry(db_session, "short_idle") - datetime.now(timezone.utc)
+    left = await _expiry(db_session, "short_idle") - datetime.now(UTC)
     # The test hub's access token lives 3600 s; the floor is that plus an hour.
     assert left > timedelta(hours=1, minutes=58)
 
@@ -98,7 +97,7 @@ async def test_no_session_renews_past_its_maximum(client, db_session):
         select(User.id).where(User.username == "long_session"))).scalar_one()
     await db_session.execute(
         update(RefreshToken).where(RefreshToken.user_id == uid)
-        .values(created_at=datetime.now(timezone.utc) - timedelta(hours=721)))
+        .values(created_at=datetime.now(UTC) - timedelta(hours=721)))
     await db_session.commit()
 
     r = await _refresh(client, current)
diff --git a/packages/meshbay-hub/tests/test_session_renewal.py b/packages/meshbay-hub/tests/test_session_renewal.py
index 5d4bcfd..7b8c108 100644
--- a/packages/meshbay-hub/tests/test_session_renewal.py
+++ b/packages/meshbay-hub/tests/test_session_renewal.py
@@ -26,9 +26,9 @@ broken client.
 """
 
 import json
+import re
 import shutil
 import subprocess
-import re
 from pathlib import Path
 
 import pytest
diff --git a/packages/meshbay-hub/tests/test_table_rows_measured.py b/packages/meshbay-hub/tests/test_table_rows_measured.py
index 60ec878..f203624 100644
--- a/packages/meshbay-hub/tests/test_table_rows_measured.py
+++ b/packages/meshbay-hub/tests/test_table_rows_measured.py
@@ -16,11 +16,10 @@ rectangles show it does not — which is what this file is for.
 """
 
 import json
+import shutil
 import subprocess
 from pathlib import Path
 
-import shutil
-
 import pytest
 
 HARNESS = Path(__file__).parent / "harness" / "layout_probe.py"