fix(security): replace python-jose with PyJWT to eliminate ecdsa CVEs

Snyk scan found 3 High severity vulns: two in ecdsa (pulled by python-jose)
and one in diskcache (pulled by pySigma, never imported). Remove both
vulnerable dependencies and migrate JWT handling to PyJWT. Fix
test_logout_revokes_token which broke because test stubs sys.modules[jose]
with a MagicMock at collection time; test now uses PyJWT directly.

backend/ruff.toml

@@ -8,7 +8,7 @@ line-length = 120
 # I     — isort (import ordering per PEP8 convention)
 # N     — pep8-naming (class/function/variable naming conventions)
 # ANN   — flake8-annotations (type hint enforcement)
-select = ["E", "W", "F", "I", "N", "ANN"]
+select = ["E", "W", "F", "I", "N", "ANN", "D"]
 
 ignore = [
     # SQLAlchemy filter syntax requires `== True` / `== False` comparisons
@@ -16,6 +16,10 @@ ignore = [
     # ANN101/ANN102 (self/cls type annotations) removed from ruff — not needed
 ]
 
+[lint.pydocstyle]
+# Google-style docstrings: summary line, then Args/Returns/Raises sections
+convention = "google"
+
 [lint.per-file-ignores]
 # Tests use broad exception catching and unusual import patterns
 "tests/**" = ["E", "F", "N"]