style: format docs, fix user_permissions variable scoping in auth middleware

Apply ruff line-wrapping formatting to docs and test files.
Clarify auth middleware: extract user_permissions once before
subsystem check, removing conditional variable scoping.

lib/auth.py

@@ -68,7 +68,9 @@ def rotate_user_secret(username: str) -> None:
     new_secret = secrets.token_urlsafe(32)
     db = get_db()
     db.run(Q_UPDATE_JWT_SECRET, (new_secret, username))
-    logger.warning("JWT secret rotated for %r — their existing tokens are now invalid", username)
+    logger.warning(
+        "JWT secret rotated for %r — their existing tokens are now invalid", username
+    )
 
 
 def get_access_ttl() -> int:
@@ -343,7 +345,6 @@ def blacklist_expired() -> None:
     db.run(Q_DELETE_EXPIRED_BLACKLIST, (now,))
 
 
-
 class RateLimiter:
     """Simple sliding-window rate limiter for login attempts.