style: formater le depot avec ruff format

QUA-002, premiere moitie. **Ce commit ne fait que reformater** : aucun
changement de comportement, aucune ligne de logique touchee. 72 fichiers,
4 restaient deja conformes. Il est isole exprès, pour que `git log -p` sur
les commits voisins reste lisible.

`quote-style = "preserve"` etait deja pose dans pyproject.toml, ce qui
evite le brassage guillemets simples / doubles : le diff porte sur les
retours a la ligne, l indentation des appels longs et les virgules
finales, pas sur le style de chaine.

Verification : 263 tests passent avant et apres, ruff check propre.

L activation en CI arrive dans le commit suivant, separement, pour que ce
diff-ci ne contienne rien d autre.

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/test_auth_session.py

@@ -121,20 +121,26 @@ class TestLogout:
         with app_with_csrf.app_context():
             from app.extensions import hash_password
             from app.models import Player
-            user = Player(username='navtest', password_hash=hash_password('Password123'),
-                          role='player', full_name='Nav Test', email='[email protected]')
+
+            user = Player(
+                username='navtest',
+                password_hash=hash_password('Password123'),
+                role='player',
+                full_name='Nav Test',
+                email='[email protected]',
+            )
             db.session.add(user)
             db.session.commit()
 
         page = client.get('/auth/login').get_data(as_text=True)
         token = re.search(r'name="csrf_token" value="([^"]+)"', page).group(1)
-        client.post('/auth/login', data={'username': 'navtest',
-                                         'password': 'Password123',
-                                         'csrf_token': token})
+        client.post(
+            '/auth/login',
+            data={'username': 'navtest', 'password': 'Password123', 'csrf_token': token},
+        )
 
         body = client.get('/users/profile').get_data(as_text=True)
-        form = re.search(
-            r'<form method="POST" action="/auth/logout".*?</form>', body, re.S)
+        form = re.search(r'<form method="POST" action="/auth/logout".*?</form>', body, re.S)
         assert form is not None, 'no logout form in the navigation'
         assert 'name="csrf_token"' in form.group(0)
 
@@ -150,9 +156,7 @@ class TestLoginRejection:
         response = client.get('/users/profile', follow_redirects=False)
         assert response.status_code in (301, 302)
 
-    def test_login_failure_message_does_not_reveal_account_existence(
-        self, client, make_user, app
-    ):
+    def test_login_failure_message_does_not_reveal_account_existence(self, client, make_user, app):
         """Compares the rendered flash messages rather than looking for a
         known substring: the site is served in French by default, so an
         English marker would silently match nothing on both sides and make
@@ -171,9 +175,7 @@ class TestLoginRejection:
 
         assert failure_message(username) == failure_message('no-such-account')
 
-    def test_the_message_stays_the_same_past_the_attempt_threshold(
-        self, client, make_user, app
-    ):
+    def test_the_message_stays_the_same_past_the_attempt_threshold(self, client, make_user, app):
         """The tally used to be counted out loud — "3 attempt(s) remaining"
         — which is the same disclosure, spread over five requests."""
         user_id = make_user('player')
@@ -200,13 +202,13 @@ class TestFailedAttemptThrottle:
     @staticmethod
     def _exhaust(client, username, times=6):
         for _ in range(times):
-            client.post('/auth/login',
-                        data={'username': username, 'password': 'WrongPassword1'},
-                        follow_redirects=True)
+            client.post(
+                '/auth/login',
+                data={'username': username, 'password': 'WrongPassword1'},
+                follow_redirects=True,
+            )
 
-    def test_the_owner_still_gets_in_after_the_threshold(
-        self, app, client, make_user, login
-    ):
+    def test_the_owner_still_gets_in_after_the_threshold(self, app, client, make_user, login):
         user_id = make_user('player')
         with app.app_context():
             username = db.session.get(User, user_id).username
@@ -294,6 +296,7 @@ class TestRedirectValidation:
 
         with app.test_request_context('/auth/login'):
             from flask import request
+
             assert is_safe_url(f'http://{request.host}/dashboard')
 
     def test_the_login_redirect_refuses_to_leave_the_site(self, client, make_user, app):