feat: comprehensive test infrastructure improvements

- Fix unit test imports: add env setup in conftest.py before module imports
- Add 24 new auth router tests (RBAC, preferences, password validation)
- Add 16 new tests for litellm and chat_summary routers
- Apply black formatting and ruff linting across codebase
- Add pre-commit hooks configuration (black, ruff, file checks)
- Increase CI coverage threshold from 40% to 50%

Test Results:
- 206 tests passing (91 unit + 115 integration)
- Coverage: 58.79% on core modules
- auth.py: 57% → 85%, litellm.py: 23% → 87%, chat_summary.py: 41% → 100%
- auth_service: 96.51%, config: 100%, rbac: 93.48%

dashboard/backend/routers/passkey.py

@@ -1,19 +1,22 @@
 """WebAuthn Passkey authentication endpoints."""
+
 import json
 import time
 from datetime import timedelta
+
 from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from fastapi.responses import JSONResponse
 from slowapi import Limiter
 from slowapi.util import get_remote_address
 from webauthn import (
-    generate_registration_options,
-    verify_registration_response,
     generate_authentication_options,
-    verify_authentication_response
+    generate_registration_options,
+    verify_authentication_response,
+    verify_registration_response,
 )
+from webauthn.helpers import base64url_to_bytes, bytes_to_base64url, options_to_json
 from webauthn.helpers.structs import PublicKeyCredentialDescriptor, UserVerificationRequirement
-from webauthn.helpers import bytes_to_base64url, base64url_to_bytes, options_to_json
+
 import auth_service as auth
 import config
 
@@ -23,6 +26,7 @@ limiter = Limiter(key_func=get_remote_address)
 # In-memory challenge store with TTL
 _challenges = {}
 
+
 def _store_challenge(challenge: bytes):
     """Store a WebAuthn challenge with timestamp for TTL tracking."""
     _challenges[challenge] = time.time()
@@ -32,12 +36,13 @@ def _store_challenge(challenge: bytes):
     for k in expired:
         _challenges.pop(k, None)
 
+
 def _get_challenge(client_data_b64: str) -> bytes:
     """Extract and validate challenge from clientDataJSON."""
     if not client_data_b64:
         raise HTTPException(status_code=400, detail="Missing clientDataJSON")
     try:
-        data = json.loads(base64url_to_bytes(client_data_b64).decode('utf-8'))
+        data = json.loads(base64url_to_bytes(client_data_b64).decode("utf-8"))
         chal_bytes = base64url_to_bytes(data.get("challenge", ""))
     except Exception:
         raise HTTPException(status_code=400, detail="Invalid clientDataJSON")
@@ -47,14 +52,12 @@ def _get_challenge(client_data_b64: str) -> bytes:
         raise HTTPException(status_code=400, detail="Challenge expired or invalid")
     return chal_bytes
 
+
 @router.post("/passkey/register/options")
-async def passkey_register_options(current_user = Depends(auth.get_current_user)):
+async def passkey_register_options(current_user=Depends(auth.get_current_user)):
     """Generate WebAuthn registration options for adding a new passkey."""
     existing = auth.load_passkey_credentials()
-    exclude = [
-        PublicKeyCredentialDescriptor(id=base64url_to_bytes(c["credential_id"]))
-        for c in existing
-    ]
+    exclude = [PublicKeyCredentialDescriptor(id=base64url_to_bytes(c["credential_id"])) for c in existing]
     options = generate_registration_options(
         rp_id=config.WEBAUTHN_RP_ID,
         rp_name="NAS Dashboard",
@@ -66,8 +69,9 @@ async def passkey_register_options(current_user = Depends(auth.get_current_user)
     _store_challenge(options.challenge)
     return JSONResponse(content=json.loads(options_to_json(options)))
 
+
 @router.post("/passkey/register/verify")
-async def passkey_register_verify(request: Request, current_user = Depends(auth.get_current_user)):
+async def passkey_register_verify(request: Request, current_user=Depends(auth.get_current_user)):
     """Verify and save a new passkey registration."""
     body = await request.json()
     challenge = _get_challenge(body.get("response", {}).get("clientDataJSON", ""))
@@ -81,15 +85,18 @@ async def passkey_register_verify(request: Request, current_user = Depends(auth.
     except Exception as e:
         raise HTTPException(status_code=400, detail=str(e))
 
-    auth.save_passkey_credential({
-        "credential_id": bytes_to_base64url(verification.credential_id),
-        "public_key": bytes_to_base64url(verification.credential_public_key),
-        "sign_count": verification.sign_count,
-        "name": body.get("name", "Passkey"),
-        "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-    })
+    auth.save_passkey_credential(
+        {
+            "credential_id": bytes_to_base64url(verification.credential_id),
+            "public_key": bytes_to_base64url(verification.credential_public_key),
+            "sign_count": verification.sign_count,
+            "name": body.get("name", "Passkey"),
+            "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+        }
+    )
     return {"ok": True}
 
+
 @router.post("/passkey/login/options")
 @limiter.limit("10/minute")
 async def passkey_login_options(request: Request):
@@ -98,10 +105,7 @@ async def passkey_login_options(request: Request):
     if not creds:
         raise HTTPException(status_code=404, detail="No passkeys registered")
 
-    allow = [
-        PublicKeyCredentialDescriptor(id=base64url_to_bytes(c["credential_id"]))
-        for c in creds
-    ]
+    allow = [PublicKeyCredentialDescriptor(id=base64url_to_bytes(c["credential_id"])) for c in creds]
     options = generate_authentication_options(
         rp_id=config.WEBAUTHN_RP_ID,
         allow_credentials=allow,
@@ -110,6 +114,7 @@ async def passkey_login_options(request: Request):
     _store_challenge(options.challenge)
     return JSONResponse(content=json.loads(options_to_json(options)))
 
+
 @router.post("/passkey/login/verify")
 @limiter.limit("10/minute")
 async def passkey_login_verify(request: Request, response: Response):
@@ -152,26 +157,24 @@ async def passkey_login_verify(request: Request, response: Response):
         "refresh_token": refresh_token,
         "token_type": "bearer",
         "user": username,
-        "role": "admin"
+        "role": "admin",
     }
 
+
 @router.get("/passkey/list")
-async def passkey_list(current_user = Depends(auth.get_current_user)):
+async def passkey_list(current_user=Depends(auth.get_current_user)):
     """List all registered passkeys for the current user."""
     creds = auth.load_passkey_credentials()
     return {
         "passkeys": [
-            {
-                "id": c["credential_id"],
-                "name": c.get("name", "Passkey"),
-                "created_at": c.get("created_at", "")
-            }
+            {"id": c["credential_id"], "name": c.get("name", "Passkey"), "created_at": c.get("created_at", "")}
             for c in creds
         ]
     }
 
+
 @router.post("/passkey/delete")
-async def passkey_delete(request: Request, current_user = Depends(auth.get_current_user)):
+async def passkey_delete(request: Request, current_user=Depends(auth.get_current_user)):
     """Delete a specific passkey by credential ID."""
     body = await request.json()
     cred_id = body.get("id")
@@ -181,8 +184,9 @@ async def passkey_delete(request: Request, current_user = Depends(auth.get_curre
     auth._save_auth_data(data)
     return {"ok": True}
 
+
 @router.post("/passkey/clear")
-async def passkey_clear(current_user = Depends(auth.get_current_user)):
+async def passkey_clear(current_user=Depends(auth.get_current_user)):
     """Clear all passkeys for the current user."""
     auth.clear_passkey_credentials()
     return {"ok": True}