feat: implement Phase 2 stabilization

- Cache Graph API tokens with expiry-aware reuse in graph/auth.py
- Add tenacity-based retry/backoff wrapper (utils/http.py) and apply to all Graph/source API calls
- Add Pydantic request/response models (models/api.py) and FastAPI query constraints
- Add unit tests for event_model, auth and integration tests for API endpoints
- Configure ruff linter/formatter in pyproject.toml
- Add GitHub Actions CI pipeline (.github/workflows/ci.yml)
- Add requirements-dev.txt with pytest, mongomock, httpx, ruff
- Clean up typing imports and fix ruff linting across codebase

backend/tests/conftest.py

@@ -0,0 +1,26 @@
+import mongomock
+import pytest
+from fastapi.testclient import TestClient
+
+
+@pytest.fixture(scope="function")
+def mock_events_collection():
+    client = mongomock.MongoClient()
+    db = client["micro_soc"]
+    coll = db["events"]
+    return coll
+
+
+@pytest.fixture(scope="function")
+def client(mock_events_collection, monkeypatch):
+    # Patch the collection in all modules that import it before the app is imported
+    monkeypatch.setattr("database.events_collection", mock_events_collection)
+    monkeypatch.setattr("routes.fetch.events_collection", mock_events_collection)
+    monkeypatch.setattr("routes.events.events_collection", mock_events_collection)
+    monkeypatch.setattr("auth.AUTH_ENABLED", False)
+    # Patch health check db.command so it doesn't need a real MongoDB server
+    monkeypatch.setattr("database.db.command", lambda cmd: {"ok": 1} if cmd == "ping" else {})
+
+    from main import app
+
+    return TestClient(app)