feat: implement Phase 2 stabilization

- Cache Graph API tokens with expiry-aware reuse in graph/auth.py
- Add tenacity-based retry/backoff wrapper (utils/http.py) and apply to all Graph/source API calls
- Add Pydantic request/response models (models/api.py) and FastAPI query constraints
- Add unit tests for event_model, auth and integration tests for API endpoints
- Configure ruff linter/formatter in pyproject.toml
- Add GitHub Actions CI pipeline (.github/workflows/ci.yml)
- Add requirements-dev.txt with pytest, mongomock, httpx, ruff
- Clean up typing imports and fix ruff linting across codebase

backend/graph/audit_logs.py

@@ -1,7 +1,8 @@
-import requests
 from datetime import datetime, timedelta
+
 from graph.auth import get_access_token
 from graph.resolve import resolve_directory_object, resolve_service_principal_owners
+from utils.http import get_with_retry
 
 
 def fetch_audit_logs(hours=24, max_pages=50):
@@ -22,13 +23,13 @@ def fetch_audit_logs(hours=24, max_pages=50):
             raise RuntimeError(f"Aborting pagination after {max_pages} pages to avoid runaway fetch.")
 
         try:
-            res = requests.get(next_url, headers=headers, timeout=20)
+            res = get_with_retry(next_url, headers=headers, timeout=20)
             res.raise_for_status()
             body = res.json()
-        except requests.RequestException as exc:
+        except RuntimeError:
+            raise
+        except Exception as exc:
             raise RuntimeError(f"Failed to fetch audit logs page: {exc}") from exc
-        except ValueError as exc:
-            raise RuntimeError(f"Invalid JSON response from Graph: {exc}") from exc
 
         events.extend(body.get("value", []))
         next_url = body.get("@odata.nextLink")