Add CI quality tooling: coverage, type checking, formatting, security

[dkijania]

Summary

Add comprehensive quality gates to the CI pipeline:

Job	Tool	What it checks
lint	ruff check	Expanded rules: pycodestyle, pyflakes, isort, naming, pyupgrade, bugbear, builtins, bandit, print, simplify, ruff
lint	ruff format	Consistent code formatting
typecheck	mypy	Type annotations, untyped defs
security	bandit	Security anti-patterns in source code
security	pip-audit	Known vulnerabilities in dependencies
test	pytest-cov	Test coverage with branch tracking (86%, threshold 70%)
build	hatchling	Only runs after all quality gates pass

New dev dependencies

• pytest-cov -- coverage reporting
• mypy -- static type checking
• bandit -- security linter
• pip-audit -- dependency vulnerability scanner

Config added to pyproject.toml

• [tool.ruff.lint] -- expanded rule set with per-file ignores
• [tool.ruff.format] -- double quotes, space indent
• [tool.mypy] -- strict untyped defs, ignore missing imports
• [tool.coverage] -- branch tracking, 70% minimum, show missing
• [tool.bandit] -- exclude tests, skip B311 (non-crypto random)

Code changes

• All source files reformatted by ruff format
• Sorted __all__ in __init__.py
• Sorted imports in examples

Test plan

• ruff check passes with expanded rules
• ruff format --check passes
• mypy src/ passes
• bandit -r src/ passes (0 issues)
• pytest --cov reports 86% coverage
• All 38 unit tests pass
• CI

🤖 Generated with Claude Code