feat: implement Phase 2 stabilization

- Cache Graph API tokens with expiry-aware reuse in graph/auth.py
- Add tenacity-based retry/backoff wrapper (utils/http.py) and apply to all Graph/source API calls
- Add Pydantic request/response models (models/api.py) and FastAPI query constraints
- Add unit tests for event_model, auth and integration tests for API endpoints
- Configure ruff linter/formatter in pyproject.toml
- Add GitHub Actions CI pipeline (.github/workflows/ci.yml)
- Add requirements-dev.txt with pytest, mongomock, httpx, ruff
- Clean up typing imports and fix ruff linting across codebase

README.md

@@ -94,6 +94,26 @@ Stored document shape (collection `micro_soc.events`):
 }
 ```
 
+## Development
+
+### Linting and formatting
+We use `ruff` for linting and formatting.
+
+```bash
+cd backend
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -r requirements.txt -r requirements-dev.txt
+ruff check ..
+ruff format ..
+```
+
+### Running tests
+```bash
+cd backend
+pytest -q
+```
+
 ## Quick smoke tests
 With the server running:
 ```bash