style: format docs, fix user_permissions variable scoping in auth middleware

Apply ruff line-wrapping formatting to docs and test files.
Clarify auth middleware: extract user_permissions once before
subsystem check, removing conditional variable scoping.

lib/auth.py

@@ -68,7 +68,9 @@ def rotate_user_secret(username: str) -> None:
     new_secret = secrets.token_urlsafe(32)
     db = get_db()
     db.run(Q_UPDATE_JWT_SECRET, (new_secret, username))
-    logger.warning("JWT secret rotated for %r — their existing tokens are now invalid", username)
+    logger.warning(
+        "JWT secret rotated for %r — their existing tokens are now invalid", username
+    )
 
 
 def get_access_ttl() -> int:
@@ -343,7 +345,6 @@ def blacklist_expired() -> None:
     db.run(Q_DELETE_EXPIRED_BLACKLIST, (now,))
 
 
-
 class RateLimiter:
     """Simple sliding-window rate limiter for login attempts.
 

lib/db_sqlite.py

@@ -56,7 +56,9 @@ class SQLiteBackend(Database):
         # Schema init is handled by direct execution, not prepared statements
         # init_tables is called as _execute_direct(INIT_SQL)
         # Users
-        Q_INSERT_USER: ("INSERT INTO users (username, password_hash, jwt_secret) VALUES (?, ?, ?)"),
+        Q_INSERT_USER: (
+            "INSERT INTO users (username, password_hash, jwt_secret) VALUES (?, ?, ?)"
+        ),
         Q_SELECT_USER_BY_NAME: (
             "SELECT id, username, password_hash, jwt_secret, created_at FROM users WHERE username = ?"
         ),