fix: tighten ruff.toml + add CI lint step (#108)

- Remove global F841/F401 suppression; scope to legacy directories via
  per-file-ignores so new files outside those paths get full enforcement
- Add per-file-ignores covering all 26 pre-existing violations that
  currently block the pre-commit hook (E711/E713/E721/E722/F811/F821)
- Keep global ignores only for genuine project patterns:
  F403/F405 (star imports in __init__.py), E712 (SQLModel ORM ==),
  F541 (1000+ legacy f-strings, cosmetic, deferred cleanup)
- Add .gitea/workflows/ruff-lint.yml — ruff check on every PR to main,
  so violations are caught before merge even if hook was bypassed

Closes #108

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ruff-lint.yml

@@ -0,0 +1,31 @@
+# Gitea Actions: Ruff Lint Check
+#
+# Runs ruff on every PR to main to catch violations before merge.
+# Complements the local pre-commit hook — violations blocked here even if
+# the developer bypassed the hook with --no-verify.
+
+name: Ruff Lint
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Set up Python
+        uses: https://github.com/actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install ruff
+        run: pip install ruff
+
+      - name: Run ruff check
+        run: ruff check .

ruff.toml

@@ -2,10 +2,36 @@
 # See https://docs.astral.sh/ruff/configuration/
 
 [lint]
-# F403/F405: star imports from exceptions.py are intentional — exceptions module
-#            exports a curated set of project exceptions via __all__
-# F541: f-strings without placeholders — cosmetic, low risk
-# F401: unused imports — many are re-exported or used conditionally
-# F841: unused variables — often intentional in SQLModel session patterns
-# E712: SQLAlchemy/SQLModel ORM comparisons to True/False require == syntax
-ignore = ["F403", "F405", "F541", "F401", "F841", "E712"]
+# Rules suppressed globally because they reflect intentional project patterns:
+#   F403/F405: star imports — __init__.py files use `from .module import *` for re-exports
+#   E712:      SQLAlchemy/SQLModel ORM comparisons require == syntax (not `is`)
+#   F541:      f-strings without placeholders — 1000+ legacy occurrences; cosmetic, deferred
+ignore = ["F403", "F405", "F541", "E712"]
+
+# Per-file suppressions for pre-existing violations in legacy code.
+# New files outside these paths get the full rule set.
+# Remove entries here as files are cleaned up.
+[lint.per-file-ignores]
+# Core cogs — F841/F401 widespread; E711/E713/F811 pre-existing
+"cogs/**" = ["F841", "F401", "E711", "E713", "F811"]
+# Game engine — F841/F401 widespread; E722/F811 pre-existing bare-excepts and redefinitions
+"in_game/**" = ["F841", "F401", "E722", "F811"]
+# Helpers — F841/F401 widespread; E721/E722 pre-existing type-comparison and bare-excepts
+"helpers/**" = ["F841", "F401", "E721", "E722"]
+# Game logic and commands
+"command_logic/**" = ["F841", "F401"]
+# Test suite — E711/F811/F821 pre-existing test assertion patterns
+"tests/**" = ["F841", "F401", "E711", "F811", "F821"]
+# Utilities
+"utilities/**" = ["F841", "F401"]
+# Migrations
+"migrations/**" = ["F401"]
+# Top-level legacy files
+"db_calls_gameplay.py" = ["F841", "F401"]
+"gauntlets.py" = ["F841", "F401"]
+"dice.py" = ["F841", "E711"]
+"manual_pack_distribution.py" = ["F841"]
+"play_lock.py" = ["F821"]
+"paperdynasty.py" = ["F401"]
+"api_calls.py" = ["F401"]
+"health_server.py" = ["F401"]