style: format docs, fix user_permissions variable scoping in auth middleware

Apply ruff line-wrapping formatting to docs and test files.
Clarify auth middleware: extract user_permissions once before
subsystem check, removing conditional variable scoping.

webui/server.py

@@ -176,7 +176,9 @@ def _auth_middleware():
 
     token_string = auth_header[7:]  # strip "Bearer "
     session_header = request.headers.get("X-Session-Id")
-    payload = validate_token(token_string, token_type="access", session_id=session_header)
+    payload = validate_token(
+        token_string, token_type="access", session_id=session_header
+    )
     if payload is None:
         return jsonify({"ok": False, "error": "unauthorized"}), 401
 
@@ -184,18 +186,19 @@ def _auth_middleware():
     if not username:
         return jsonify({"ok": False, "error": "unauthorized"}), 401
 
+    user_permissions = payload.get("permissions", {})
+
     # Check subsystem permissions
     subsystem = _subsystem_from_path(path)
     if subsystem:
-        perms = payload.get("permissions", {})
-        if subsystem not in perms:
+        if subsystem not in user_permissions:
             return jsonify({"ok": False, "error": "forbidden"}), 403
-        if not _has_permission(perms, subsystem, method):
+        if not _has_permission(user_permissions, subsystem, method):
             return jsonify({"ok": False, "error": "forbidden"}), 403
 
     request._user_ctx = {
         "username": username,
-        "permissions": perms if subsystem else payload.get("permissions", {}),
+        "permissions": user_permissions,
         "jti": payload.get("jti"),
     }
     return