feat: implement Phase 2 stabilization

- Cache Graph API tokens with expiry-aware reuse in graph/auth.py
- Add tenacity-based retry/backoff wrapper (utils/http.py) and apply to all Graph/source API calls
- Add Pydantic request/response models (models/api.py) and FastAPI query constraints
- Add unit tests for event_model, auth and integration tests for API endpoints
- Configure ruff linter/formatter in pyproject.toml
- Add GitHub Actions CI pipeline (.github/workflows/ci.yml)
- Add requirements-dev.txt with pytest, mongomock, httpx, ruff
- Clean up typing imports and fix ruff linting across codebase

backend/maintenance.py

@@ -7,14 +7,12 @@ new display fields. Example:
     python maintenance.py renormalize --limit 500
 """
 import argparse
-from typing import List, Set
-
-from pymongo import UpdateOne
 
 from database import events_collection
-from graph.auth import get_access_token
 from graph.audit_logs import _enrich_events
-from models.event_model import normalize_event, _make_dedupe_key
+from graph.auth import get_access_token
+from models.event_model import _make_dedupe_key, normalize_event
+from pymongo import UpdateOne
 
 
 def renormalize(limit: int = None, batch_size: int = 200) -> int:
@@ -29,7 +27,7 @@ def renormalize(limit: int = None, batch_size: int = 200) -> int:
         cursor = cursor.limit(int(limit))
 
     updated = 0
-    batch: List[UpdateOne] = []
+    batch: list[UpdateOne] = []
 
     for doc in cursor:
         raw = doc.get("raw") or {}
@@ -59,7 +57,7 @@ def dedupe(limit: int = None, batch_size: int = 500) -> int:
     if limit:
         cursor = cursor.limit(int(limit))
 
-    seen: Set[str] = set()
+    seen: set[str] = set()
     to_delete = []
     processed = 0