style: apply ruff format across backend + scripts (line-length 100)

Mechanical, whole-tree `ruff format` pass — no behaviour change. Recorded in
.git-blame-ignore-revs (next commit) so git blame skips it.

backend/tests/test_auth_session.py

@@ -9,6 +9,7 @@ override) so login, the wallet gate and epoch revoke are the code under test.
 Note: `/api/me` is the bootstrap probe — it returns 200 `{authenticated: False}` when logged out, not a
 401. A revoked session is therefore checked on a PROTECTED endpoint (`/api/feed`), which does 401.
 """
+
 from datetime import timedelta
 
 from fastapi.testclient import TestClient
@@ -82,13 +83,17 @@ def test_reset_confirm_is_single_use_and_kills_existing_sessions(client, make_us
 
     raw = _issue_token(db, user, "reset", timedelta(hours=1))
     db.commit()
-    ok = client.post("/auth/password-reset/confirm", json={"token": raw, "password": "brand new pw!"})
+    ok = client.post(
+        "/auth/password-reset/confirm", json={"token": raw, "password": "brand new pw!"}
+    )
     assert ok.status_code == 200
 
     # A reset bumps the epoch (compromise response) -> the pre-reset cookie is now rejected.
     assert client.get("/api/feed").status_code == 401
     # The token is single-use: a replay is a clean 400, not a second reset.
-    replay = client.post("/auth/password-reset/confirm", json={"token": raw, "password": "another pw!!"})
+    replay = client.post(
+        "/auth/password-reset/confirm", json={"token": raw, "password": "another pw!!"}
+    )
     assert replay.status_code == 400
 
 
@@ -99,7 +104,10 @@ def test_activating_an_unverified_account_drops_its_preset_password(db, make_use
     from app.routes.admin import _activate_user_by_email
 
     victim = make_user(
-        email="victim@example.com", password="attacker-chosen", email_verified=False, is_active=False
+        email="victim@example.com",
+        password="attacker-chosen",
+        email_verified=False,
+        is_active=False,
     )
     epoch0 = victim.session_epoch or 0
     _activate_user_by_email(db, "victim@example.com")