chore: add pre-commit ruff hook with auto-fix

- scripts/hooks/pre-commit: runs ruff --fix for root and web/ (matching CI)
  and re-stages any auto-fixed files so they land in the commit
- Makefile: add install-hooks target (run once after clone)
- pyproject.toml: exclude web/ from root ruff (web has its own config)
- Fix remaining import sort warnings caught by the new hook

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Makefile

@@ -2,7 +2,7 @@ TAILWIND_VERSION := v4.1.18
 TAILWIND         := web/bin/tailwindcss
 SOPS_DOTENV      := sops --input-type dotenv --output-type dotenv
 
-.PHONY: help dev css-build css-watch \
+.PHONY: help dev css-build css-watch install-hooks \
         secrets-decrypt-dev secrets-decrypt-prod \
         secrets-edit-dev secrets-edit-prod \
         secrets-encrypt-dev secrets-encrypt-prod \
@@ -13,6 +13,7 @@ help:
 	@echo "  dev                    Start full dev environment (migrate, seed, app + worker + CSS watcher)"
 	@echo "  css-build              Build + minify Tailwind CSS"
 	@echo "  css-watch              Watch + rebuild Tailwind CSS"
+	@echo "  install-hooks          Install git pre-commit hook (run once after cloning)"
 	@echo "  secrets-decrypt-dev    Decrypt .env.dev.sops → .env"
 	@echo "  secrets-decrypt-prod   Decrypt .env.prod.sops → .env"
 	@echo "  secrets-edit-dev       Edit .env.dev.sops in \$$EDITOR"
@@ -23,6 +24,11 @@ help:
 
 # ── Dev environment ───────────────────────────────────────────────────────────
 
+install-hooks:
+	cp scripts/hooks/pre-commit .git/hooks/pre-commit
+	chmod +x .git/hooks/pre-commit
+	@echo "✓ pre-commit hook installed"
+
 dev:
 	@./web/scripts/dev_run.sh