fix: resolve all ruff lint errors and type checker warnings

- Use Annotated[str, Form()] for FastAPI dependencies (FAST002)
- Add missing type annotations across src/ and tests/ (ANN001/003/201/202)
- Reduce function arguments via request.form() reads (PLR0913)
- Combine return paths to reduce return statements (PLR0911)
- Use anyio.Path for async-safe filesystem operations (ASYNC240)
- Extract constants, helpers, and dict comprehensions for clarity
- Move inline imports to top-level (PLC0415)
- Use raw strings for regex match patterns (RUF043)
- Fix redundant get_session_user call in delete_user (not-iterable)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/test_app.py

@@ -1,5 +1,18 @@
+from unittest.mock import MagicMock
+
 from httpx import AsyncClient
 
+from porchlight.dependencies import (
+    get_credential_repo,
+    get_magic_link_repo,
+    get_user_repo,
+)
+from porchlight.store.protocols import (
+    CredentialRepository,
+    MagicLinkRepository,
+    UserRepository,
+)
+
 
 async def test_health_endpoint(client: AsyncClient) -> None:
     response = await client.get("/health")
@@ -16,12 +29,6 @@ async def test_app_has_title(client: AsyncClient) -> None:
 
 
 async def test_app_has_repos_on_state(client: AsyncClient) -> None:
-    from porchlight.store.protocols import (
-        CredentialRepository,
-        MagicLinkRepository,
-        UserRepository,
-    )
-
     app = client._transport.app  # type: ignore[union-attr]
     assert isinstance(app.state.user_repo, UserRepository)
     assert isinstance(app.state.credential_repo, CredentialRepository)
@@ -41,14 +48,6 @@ async def test_landing_page(client: AsyncClient) -> None:
 
 
 async def test_dependency_functions() -> None:
-    from unittest.mock import MagicMock
-
-    from porchlight.dependencies import (
-        get_credential_repo,
-        get_magic_link_repo,
-        get_user_repo,
-    )
-
     request = MagicMock()
     request.app.state.user_repo = "user_repo_sentinel"
     request.app.state.credential_repo = "credential_repo_sentinel"