chore: add pre-commit ruff hook with auto-fix

- scripts/hooks/pre-commit: runs ruff --fix for root and web/ (matching CI)
  and re-stages any auto-fixed files so they land in the commit
- Makefile: add install-hooks target (run once after clone)
- pyproject.toml: exclude web/ from root ruff (web has its own config)
- Fix remaining import sort warnings caught by the new hook

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/tests/test_roles.py

@@ -3,8 +3,6 @@ Tests for role-based access control: role_required decorator, grant/revoke/ensur
 and admin route protection.
 """
 import pytest
-from quart import Blueprint
-
 from beanflows import core
 from beanflows.auth.routes import (
     ensure_admin_role,
@@ -12,6 +10,7 @@ from beanflows.auth.routes import (
     revoke_role,
     role_required,
 )
+from quart import Blueprint
 
 # ════════════════════════════════════════════════════════════
 # grant_role / revoke_role