style: ruff's own fixes, mechanically applied

`ruff check .` had gone unrun long enough to report 568 errors, which is the
same as having no linter: the next real finding would have been invisible in the
noise. This is the 521 it fixes by itself, in 173 files, and nothing else — the
98 it cannot fix are the next commit.

What actually changed: import sorting (225), imports nobody used (87, none of
them a re-export — no `__init__.py` is touched, which was the one way this could
have broken an import elsewhere), `datetime.timezone.utc` to `datetime.UTC` (69)
and `asyncio.TimeoutError` to `TimeoutError` (18), both plain aliases on the 3.12
this project requires, `Optional[X]` to `X | None` (24), and f-strings with
nothing to interpolate (19).

Checked rather than assumed: every module in the three packages still imports,
and the suite is 2893 passed — the same count, test for test, as the merge
before it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 19 insertions, 11 deletions

diff --git a/packages/meshbay-node/tests/test_security_regressions.py b/packages/meshbay-node/tests/test_security_regressions.py
index d6ecb71..bfe25b9 100644
--- a/packages/meshbay-node/tests/test_security_regressions.py
+++ b/packages/meshbay-node/tests/test_security_regressions.py
@@ -9,20 +9,18 @@ only ever exercised happy paths, never an authorization boundary.
 If one of these starts failing, a fix has been reverted. Do not "fix" the test.
 """
 
-import base64
 import struct
 from pathlib import Path
 
 import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-
 from meshbay_common.crypto import generate_gek
-from meshbay_common.protocol import IndexEntry
 from meshbay_node.indexer.group_index import GroupIndex
 from meshbay_node.roots import RootSet
-from conftest import one_root, opened_ack, sealed_upload
 from meshbay_node.transport.webrtc_server import WebRTCPeerSession
 
+from conftest import one_root, opened_ack, sealed_upload
+
 
 def _safe_name_re():
     """
@@ -64,7 +62,7 @@ def test_daemon_exposes_no_plaintext_listener():
     C1: the daemon must not bind anything that serves content without a handshake.
     NodeConfig no longer carries an HTTP port at all.
     """
-    from meshbay_node.config import NodeConfig, GroupConfig
+    from meshbay_node.config import GroupConfig, NodeConfig
 
     assert "http_port" not in NodeConfig.__dataclass_fields__
     assert "http_port" not in GroupConfig.__dataclass_fields__
@@ -568,6 +566,7 @@ def test_admin_signature_does_not_transfer_between_operations(tmp_path):
 def test_admin_challenge_expires(tmp_path):
     """H5: a stale challenge must not be usable."""
     import time as _time
+
     from meshbay_common.adminop import ADMIN_CHALLENGE_TTL, OP_FILE_DELETE
 
     session = _session(tmp_path, "operator")
@@ -633,6 +632,7 @@ def test_keystore_records_argon2_params_for_migration(tmp_path):
     envelope records the parameters it was written with.
     """
     import json
+
     from meshbay_node.keystore import create_keystore, load_keystore
 
     path = tmp_path / "keystore.enc"
@@ -648,11 +648,17 @@ def test_legacy_keystore_still_opens(tmp_path):
     """M2: a keystore written under the 64 MB profile must still unlock."""
     import base64 as _b64
     import json
+
     import msgpack
     from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
     from meshbay_common.crypto import (
-        LEGACY_ARGON2_ITERATIONS, LEGACY_ARGON2_LANES, LEGACY_ARGON2_MEMORY_COST,
-        derive_keystore_key, encrypt_keystore, pk_to_b64, sk_to_b64,
+        LEGACY_ARGON2_ITERATIONS,
+        LEGACY_ARGON2_LANES,
+        LEGACY_ARGON2_MEMORY_COST,
+        derive_keystore_key,
+        encrypt_keystore,
+        pk_to_b64,
+        sk_to_b64,
     )
     from meshbay_node.keystore import load_keystore
 
@@ -717,7 +723,9 @@ def test_pre_handshake_message_budget_is_small():
     unauthenticated peer could announce a huge frame and dribble bytes into it.
     """
     from meshbay_node.transport.webrtc_server import (
-        MAX_MSG, PRE_HANDSHAKE_MAX_MSG, _DataChannelBuffer,
+        MAX_MSG,
+        PRE_HANDSHAKE_MAX_MSG,
+        _DataChannelBuffer,
     )
     assert PRE_HANDSHAKE_MAX_MSG <= 1024 * 1024
     assert PRE_HANDSHAKE_MAX_MSG < MAX_MSG
@@ -918,8 +926,8 @@ async def test_an_identified_device_that_is_not_an_operator_is_refused(tmp_path)
     and `operator_pks()` is rebuilt from the roster on every call so a revoked
     one stops working at once.
     """
-    from meshbay_node.roster import Roster
     from meshbay_common.crypto import pk_to_b64
+    from meshbay_node.roster import Roster
 
     roster = Roster(db_path=tmp_path / "roster.db")
     await roster.open()
@@ -940,9 +948,9 @@ async def test_an_identified_device_that_is_not_an_operator_is_refused(tmp_path)
 async def test_a_paired_operator_device_is_what_opens_it(tmp_path):
     """The positive case, so the test above is about authority and not about
     everything being refused."""
-    from meshbay_node.roster import Roster
-    from meshbay_common.join import ROLE_OPERATOR
     from meshbay_common.crypto import pk_to_b64
+    from meshbay_common.join import ROLE_OPERATOR
+    from meshbay_node.roster import Roster
 
     roster = Roster(db_path=tmp_path / "roster.db")
     await roster.open()