chore: add pre-commit ruff hook with auto-fix

- scripts/hooks/pre-commit: runs ruff --fix for root and web/ (matching CI)
  and re-stages any auto-fixed files so they land in the commit
- Makefile: add install-hooks target (run once after clone)
- pyproject.toml: exclude web/ from root ruff (web has its own config)
- Fix remaining import sort warnings caught by the new hook

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/tests/conftest.py

@@ -7,7 +7,6 @@ from unittest.mock import AsyncMock, patch
 
 import aiosqlite
 import pytest
-
 from beanflows import core
 from beanflows.app import create_app
 

web/tests/test_billing_helpers.py

@@ -2,10 +2,6 @@
 Unit tests for billing SQL helpers, feature/limit access, and plan determination.
 """
 import pytest
-from hypothesis import HealthCheck, given
-from hypothesis import settings as h_settings
-from hypothesis import strategies as st
-
 from beanflows.billing.routes import (
     can_access_feature,
     get_billing_customer,
@@ -18,6 +14,9 @@ from beanflows.billing.routes import (
     upsert_subscription,
 )
 from beanflows.core import config
+from hypothesis import HealthCheck, given
+from hypothesis import settings as h_settings
+from hypothesis import strategies as st
 
 # ════════════════════════════════════════════════════════════
 # get_subscription

web/tests/test_billing_hooks.py

@@ -2,7 +2,6 @@
 Tests for the billing event hook system.
 """
 import pytest
-
 from beanflows.billing.routes import _billing_hooks, _fire_hooks, on_billing_event
 
 

web/tests/test_billing_routes.py

@@ -144,9 +144,8 @@ class TestCancelRoute:
 # subscription_required decorator
 # ════════════════════════════════════════════════════════════
 
-from quart import Blueprint  # noqa: E402
-
 from beanflows.auth.routes import subscription_required  # noqa: E402
+from quart import Blueprint  # noqa: E402
 
 test_bp = Blueprint("test", __name__)
 

web/tests/test_billing_webhooks.py

@@ -5,13 +5,12 @@ Covers signature verification, event parsing, subscription lifecycle transitions
 import json
 
 import pytest
+from beanflows.billing.routes import get_billing_customer, get_subscription
 from conftest import make_webhook_payload, sign_payload
 from hypothesis import HealthCheck, given
 from hypothesis import settings as h_settings
 from hypothesis import strategies as st
 
-from beanflows.billing.routes import get_billing_customer, get_subscription
-
 WEBHOOK_PATH = "/billing/webhook/paddle"
 SIG_HEADER = "Paddle-Signature"
 

web/tests/test_roles.py

@@ -3,8 +3,6 @@ Tests for role-based access control: role_required decorator, grant/revoke/ensur
 and admin route protection.
 """
 import pytest
-from quart import Blueprint
-
 from beanflows import core
 from beanflows.auth.routes import (
     ensure_admin_role,
@@ -12,6 +10,7 @@ from beanflows.auth.routes import (
     revoke_role,
     role_required,
 )
+from quart import Blueprint
 
 # ════════════════════════════════════════════════════════════
 # grant_role / revoke_role