style: format docs, fix user_permissions variable scoping in auth middleware

Apply ruff line-wrapping formatting to docs and test files.
Clarify auth middleware: extract user_permissions once before
subsystem check, removing conditional variable scoping.

tests/test_auth.py

@@ -160,7 +160,9 @@ class TestDBLayer:
     def test_transaction_rollback(self, db):
         try:
             with db.in_transaction() as tx:
-                tx.run(Q_INSERT_USER, ("rollback_user", "$argon2id$hash", "test-secret"))
+                tx.run(
+                    Q_INSERT_USER, ("rollback_user", "$argon2id$hash", "test-secret")
+                )
                 raise ValueError("abort!")
         except ValueError:
             pass
@@ -209,27 +211,35 @@ class TestJWT:
 
     def test_generate_token_with_session_id(self):
         """Token includes session_id in payload."""
-        token = generate_access_token("admin", {"firewall": "rw"}, session_id="test-session-123")
+        token = generate_access_token(
+            "admin", {"firewall": "rw"}, session_id="test-session-123"
+        )
         payload = decode_token(token)
         assert payload is not None
         assert payload["session_id"] == "test-session-123"
 
     def test_session_id_validation_match(self):
         """Token with matching session_id validates."""
-        token = generate_access_token("admin", {"firewall": "rw"}, session_id="my-session")
+        token = generate_access_token(
+            "admin", {"firewall": "rw"}, session_id="my-session"
+        )
         payload = validate_token(token, "access", session_id="my-session")
         assert payload is not None
         assert payload["sub"] == "admin"
 
     def test_session_id_validation_mismatch(self):
         """Token with wrong session_id is rejected."""
-        token = generate_access_token("admin", {"firewall": "rw"}, session_id="real-session")
+        token = generate_access_token(
+            "admin", {"firewall": "rw"}, session_id="real-session"
+        )
         payload = validate_token(token, "access", session_id="wrong-session")
         assert payload is None
 
     def test_session_id_optional(self):
         """Token validates without session_id when none is required."""
-        token = generate_access_token("admin", {"firewall": "rw"}, session_id="my-session")
+        token = generate_access_token(
+            "admin", {"firewall": "rw"}, session_id="my-session"
+        )
         payload = validate_token(token, "access")
         assert payload is not None