refactor(types): PEP-604 union sweep + UP007/UP045 enforcement

ruff --select UP007,UP045 --fix converted ~1760 sites across the
backend: `Optional[T]` → `T | None`, `Union[X, Y]` → `X | Y`. The
remaining module-level alias targets that ruff conservatively skips
(BindableFloatInput, ColorList, DeviceConfig) were converted by hand
earlier in the pass. black -formatted the result so the wider unions
fit cleanly under the 100-char line budget.

pyproject.toml now sets [tool.ruff.lint] extend-select = ["UP007",
"UP045"] so future legacy imports fire CI on every push. The
pre-commit ruff hook was bumped from v0.8.0 -> v0.15.12 to recognise
UP045 (split off from UP007 in v0.13).

server/tests/e2e/test_auth_flow.py

@@ -8,8 +8,6 @@ helpers to make unauthenticated requests by temporarily removing the header.
 """
 
 
-
-
 def _unauth_get(client, url):
     """Make a GET request without the Authorization header."""
     saved = client.headers.pop("Authorization", None)
@@ -54,7 +52,9 @@ class TestAuthEnforcement:
     def test_request_with_wrong_key_returns_401(self, client):
         """Protected endpoint with an incorrect API key returns 401."""
         resp = _with_header(
-            client, "GET", "/api/v1/devices",
+            client,
+            "GET",
+            "/api/v1/devices",
             auth_value="Bearer wrong-key-12345",
         )
         assert resp.status_code == 401
@@ -82,7 +82,9 @@ class TestAuthEnforcement:
     def test_post_without_auth_returns_401(self, client):
         """Creating a device without auth fails."""
         resp = _unauth_request(
-            client, "POST", "/api/v1/devices",
+            client,
+            "POST",
+            "/api/v1/devices",
             json={
                 "name": "Unauthorized Device",
                 "url": "mock://test",
@@ -115,7 +117,9 @@ class TestAuthEnforcement:
     def test_malformed_bearer_token_returns_401_or_403(self, client):
         """A malformed Authorization header is rejected."""
         resp = _with_header(
-            client, "GET", "/api/v1/devices",
+            client,
+            "GET",
+            "/api/v1/devices",
             auth_value="just-a-key",
         )
         # FastAPI's HTTPBearer returns 403 for malformed format,