refactor(pep8): enforce full PEP8 compliance across backend Python codebase

- ruff.toml: select E/W/F/I/N rules, line-length=120, drop legacy ignores
- Auto-fix: sort 82 import blocks (isort), remove 29 unused imports,
  strip 6 trailing-whitespace blank lines in docstrings
- main.py: move setup_logging and settings imports to top (E402)
- errors.py: noqa N818 on DDD exception names (96 call sites, safe)
- intel_service.py: noqa N817 for universal ET alias
- atomic/elastic/sigma import services: move _MAX_UNCOMPRESSED_SIZE and
  _MAX_ENTRIES to module level (N806)
- compliance_import_service.py: move SAMPLE_CONTROLS / CIS_CONTROLS to
  module level; wrap long description strings (N806 + E501)
- snapshot_service.py: move STATUS_ORDER dict to module level (N806)
- sigma_import_service.py: remove dead dedup_key expression (F841)
- threat_actor_import_service.py: remove dead stix_to_actor expression (F841)
- data_source.py, seed_demo.py, campaign_scheduler_service.py,
  lolbas_import_service.py: wrap lines exceeding 120 chars (E501)
- d3fend_import_service.py: per-file E501 ignore (data file with long strings)

All 439 unit tests pass. ruff check app/ → All checks passed!

backend/app/models/__init__.py

@@ -1,26 +1,30 @@
 # Import all models here so Alembic can detect them
-from app.models.user import User
-from app.models.technique import Technique
-from app.models.test import Test
-from app.models.test_template import TestTemplate
+from app.models.audit import AuditLog
+from app.models.campaign import Campaign, CampaignTest
+from app.models.compliance import (
+    ComplianceControl,
+    ComplianceControlMapping,
+    ComplianceFramework,
+)
+from app.models.coverage_snapshot import CoverageSnapshot, SnapshotTechniqueState
+from app.models.data_source import DataSource
+from app.models.defensive_technique import DefensiveTechnique, DefensiveTechniqueMapping
+from app.models.detection_rule import DetectionRule
+from app.models.enums import TeamSide, TechniqueStatus, TestResult, TestState
 from app.models.evidence import Evidence
 from app.models.intel import IntelItem
-from app.models.audit import AuditLog
-from app.models.notification import Notification
-from app.models.data_source import DataSource
-from app.models.detection_rule import DetectionRule
-from app.models.threat_actor import ThreatActor, ThreatActorTechnique
-from app.models.defensive_technique import DefensiveTechnique, DefensiveTechniqueMapping
-from app.models.test_template_detection_rule import TestTemplateDetectionRule
-from app.models.test_detection_result import TestDetectionResult
-from app.models.campaign import Campaign, CampaignTest
-from app.models.compliance import ComplianceFramework, ComplianceControl, ComplianceControlMapping
-from app.models.coverage_snapshot import CoverageSnapshot, SnapshotTechniqueState
 from app.models.jira_link import JiraLink, JiraLinkEntityType, JiraSyncDirection
-from app.models.worklog import Worklog
+from app.models.notification import Notification
 from app.models.osint_item import OsintItem
 from app.models.scoring_config import ScoringConfig
-from app.models.enums import TechniqueStatus, TestState, TestResult, TeamSide
+from app.models.technique import Technique
+from app.models.test import Test
+from app.models.test_detection_result import TestDetectionResult
+from app.models.test_template import TestTemplate
+from app.models.test_template_detection_rule import TestTemplateDetectionRule
+from app.models.threat_actor import ThreatActor, ThreatActorTechnique
+from app.models.user import User
+from app.models.worklog import Worklog
 
 __all__ = [
     "User", "Technique", "Test", "TestTemplate", "Evidence",

backend/app/models/audit.py

@@ -1,6 +1,7 @@
 import uuid
-from sqlalchemy import Column, String, DateTime, ForeignKey, Index, func
-from sqlalchemy.dialects.postgresql import UUID, JSONB
+
+from sqlalchemy import Column, DateTime, ForeignKey, Index, String, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.orm import relationship
 
 from app.database import Base
@@ -9,7 +10,7 @@ from app.database import Base
 class AuditLog(Base):
     """
     Audit log model for tracking all system actions.
-    
+
     Records user actions, entity changes, and system events
     for security auditing and compliance purposes.
     """

backend/app/models/campaign.py

@@ -5,11 +5,19 @@ enabling simulation of complete attack chains and APT emulations.
 """
 
 import uuid
+
 from sqlalchemy import (
-    Column, String, Text, Integer, Boolean, DateTime,
-    ForeignKey, Index, func,
+    Boolean,
+    Column,
+    DateTime,
+    ForeignKey,
+    Index,
+    Integer,
+    String,
+    Text,
+    func,
 )
-from sqlalchemy.dialects.postgresql import UUID, JSONB
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.orm import relationship
 
 from app.database import Base

backend/app/models/compliance.py

@@ -5,9 +5,17 @@ MITRE ATT&CK techniques, enabling compliance gap analysis.
 """
 
 import uuid
+
 from sqlalchemy import (
-    Column, String, Text, Boolean, DateTime,
-    ForeignKey, Index, UniqueConstraint, func,
+    Boolean,
+    Column,
+    DateTime,
+    ForeignKey,
+    Index,
+    String,
+    Text,
+    UniqueConstraint,
+    func,
 )
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import relationship

backend/app/models/coverage_snapshot.py

@@ -6,9 +6,16 @@ per technique per snapshot) to avoid bloated JSONB fields.
 """
 
 import uuid
+
 from sqlalchemy import (
-    Column, String, Float, Integer, DateTime,
-    ForeignKey, Index, func,
+    Column,
+    DateTime,
+    Float,
+    ForeignKey,
+    Index,
+    Integer,
+    String,
+    func,
 )
 from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.orm import relationship

backend/app/models/data_source.py

@@ -1,8 +1,9 @@
 """DataSource model — registry of external data sources for import."""
 
 import uuid
-from sqlalchemy import Column, String, Text, Boolean, DateTime, Index, func
-from sqlalchemy.dialects.postgresql import UUID, JSONB
+
+from sqlalchemy import Boolean, Column, DateTime, Index, String, Text, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 
 from app.database import Base
 
@@ -20,7 +21,8 @@ class DataSource(Base):
     id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
     name = Column(String, unique=True, nullable=False)            # e.g. "atomic_red_team"
     display_name = Column(String, nullable=False)                  # e.g. "Atomic Red Team"
-    type = Column(String, nullable=False)                          # attack_procedure / detection_rule / threat_intel / defensive_technique
+    # Values: attack_procedure / detection_rule / threat_intel / defensive_technique
+    type = Column(String, nullable=False)
     url = Column(String, nullable=True)                            # URL base of repo/API
     description = Column(Text, nullable=True)
     is_enabled = Column(Boolean, default=True)

backend/app/models/defensive_technique.py

@@ -5,9 +5,16 @@ ATT&CK techniques, enabling recommended countermeasure lookups.
 """
 
 import uuid
+
 from sqlalchemy import (
-    Column, String, Text, DateTime,
-    ForeignKey, Index, UniqueConstraint, func,
+    Column,
+    DateTime,
+    ForeignKey,
+    Index,
+    String,
+    Text,
+    UniqueConstraint,
+    func,
 )
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import relationship

backend/app/models/detection_rule.py

@@ -1,8 +1,9 @@
 """DetectionRule model — detection rules from multiple sources."""
 
 import uuid
-from sqlalchemy import Column, String, Text, Boolean, DateTime, Index, func
-from sqlalchemy.dialects.postgresql import UUID, JSONB
+
+from sqlalchemy import Boolean, Column, DateTime, Index, String, Text, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 
 from app.database import Base
 

backend/app/models/evidence.py

@@ -1,5 +1,6 @@
 import uuid
-from sqlalchemy import Column, String, Text, DateTime, ForeignKey, Enum, func
+
+from sqlalchemy import Column, DateTime, Enum, ForeignKey, String, Text, func
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import relationship
 
@@ -10,10 +11,10 @@ from app.models.enums import TeamSide
 class Evidence(Base):
     """
     Evidence model for storing file metadata associated with tests.
-    
+
     Files are stored in MinIO, and this model tracks the file location,
     integrity hash, and upload metadata.
-    
+
     The ``team`` field distinguishes whether this evidence was uploaded by
     Red Team (attack evidence) or Blue Team (detection evidence).
     """

backend/app/models/intel.py

@@ -1,5 +1,6 @@
 import uuid
-from sqlalchemy import Column, String, Boolean, DateTime, ForeignKey, func
+
+from sqlalchemy import Boolean, Column, DateTime, ForeignKey, String, func
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import relationship
 
@@ -9,7 +10,7 @@ from app.database import Base
 class IntelItem(Base):
     """
     Intelligence item model for tracking threat intelligence related to techniques.
-    
+
     Stores URLs and metadata from automated intel scans that may indicate
     new attack variations or detection bypasses for specific techniques.
     """

backend/app/models/jira_link.py

@@ -2,8 +2,10 @@
 
 import enum
 import uuid
-from sqlalchemy import Column, String, DateTime, ForeignKey, Enum as SQLEnum, Index, func
-from sqlalchemy.dialects.postgresql import UUID, JSONB
+
+from sqlalchemy import Column, DateTime, ForeignKey, Index, String, func
+from sqlalchemy import Enum as SQLEnum
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.orm import relationship
 
 from app.database import Base

backend/app/models/notification.py

@@ -1,7 +1,8 @@
 """Notification model — in-app notifications for user actions."""
 
 import uuid
-from sqlalchemy import Column, String, Text, Boolean, DateTime, ForeignKey, Index, func
+
+from sqlalchemy import Boolean, Column, DateTime, ForeignKey, Index, String, Text, func
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import relationship
 

backend/app/models/osint_item.py

@@ -1,8 +1,9 @@
 """OSINT enrichment items — CVEs, blogs, PoCs, and advisories linked to techniques."""
 
 import uuid
-from sqlalchemy import Column, String, Text, Boolean, DateTime, ForeignKey, func
-from sqlalchemy.dialects.postgresql import UUID, JSONB
+
+from sqlalchemy import Boolean, Column, DateTime, ForeignKey, String, Text, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.orm import relationship
 
 from app.database import Base

backend/app/models/scoring_config.py

@@ -2,7 +2,7 @@
 
 import uuid
 
-from sqlalchemy import Column, Float, DateTime, ForeignKey, func
+from sqlalchemy import Column, DateTime, Float, ForeignKey, func
 from sqlalchemy.dialects.postgresql import UUID
 
 from app.database import Base

backend/app/models/technique.py

@@ -1,8 +1,7 @@
 import uuid
-from datetime import datetime
 
-from sqlalchemy import Column, String, Text, Boolean, DateTime, Enum
-from sqlalchemy.dialects.postgresql import UUID, JSONB
+from sqlalchemy import Boolean, Column, DateTime, Enum, String, Text
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.orm import relationship
 
 from app.database import Base
@@ -12,7 +11,7 @@ from app.models.enums import TechniqueStatus
 class Technique(Base):
     """
     MITRE ATT&CK Technique model.
-    
+
     Represents an attack technique from the MITRE ATT&CK framework,
     including its coverage status and associated tests.
     """

backend/app/models/test.py

@@ -1,10 +1,22 @@
 import uuid
-from sqlalchemy import Column, String, Text, Boolean, Integer, DateTime, ForeignKey, Enum, Index, func
+
+from sqlalchemy import (
+    Boolean,
+    Column,
+    DateTime,
+    Enum,
+    ForeignKey,
+    Index,
+    Integer,
+    String,
+    Text,
+    func,
+)
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import relationship
 
 from app.database import Base
-from app.models.enums import TestState, TestResult
+from app.models.enums import TestResult, TestState
 
 
 class Test(Base):

backend/app/models/test_detection_result.py

@@ -5,9 +5,16 @@ rule as triggered / not triggered / not applicable, along with notes.
 """
 
 import uuid
-from datetime import datetime
 
-from sqlalchemy import Column, String, Text, Boolean, DateTime, ForeignKey, Index, UniqueConstraint
+from sqlalchemy import (
+    Boolean,
+    Column,
+    DateTime,
+    ForeignKey,
+    Index,
+    Text,
+    UniqueConstraint,
+)
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import relationship
 

backend/app/models/test_template.py

@@ -1,7 +1,8 @@
 """TestTemplate model — predefined test catalog entries."""
 
 import uuid
-from sqlalchemy import Column, String, Text, Boolean, DateTime, Index, func
+
+from sqlalchemy import Boolean, Column, DateTime, Index, String, Text, func
 from sqlalchemy.dialects.postgresql import UUID
 
 from app.database import Base

backend/app/models/test_template_detection_rule.py

@@ -5,9 +5,8 @@ for a given test template / attack procedure.
 """
 
 import uuid
-from datetime import datetime
 
-from sqlalchemy import Column, Boolean, ForeignKey, Index, UniqueConstraint
+from sqlalchemy import Boolean, Column, ForeignKey, Index, UniqueConstraint
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import relationship
 

backend/app/models/threat_actor.py

@@ -5,11 +5,19 @@ techniques, imported from MITRE CTI (STIX 2.0).
 """
 
 import uuid
+
 from sqlalchemy import (
-    Column, String, Text, Boolean, DateTime,
-    ForeignKey, Index, UniqueConstraint, func,
+    Boolean,
+    Column,
+    DateTime,
+    ForeignKey,
+    Index,
+    String,
+    Text,
+    UniqueConstraint,
+    func,
 )
-from sqlalchemy.dialects.postgresql import UUID, JSONB
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.orm import relationship
 
 from app.database import Base

backend/app/models/user.py

@@ -1,5 +1,6 @@
 import uuid
-from sqlalchemy import Column, String, Boolean, DateTime, func
+
+from sqlalchemy import Boolean, Column, DateTime, String, func
 from sqlalchemy.dialects.postgresql import UUID
 
 from app.database import Base
@@ -8,7 +9,7 @@ from app.database import Base
 class User(Base):
     """
     User model for authentication and authorization.
-    
+
     Possible roles:
     - admin: Full system access
     - red_tech: Red team technician - can create and edit tests

backend/app/models/worklog.py

@@ -1,8 +1,9 @@
 """Worklog model — immutable internal time-tracking records."""
 
 import uuid
-from sqlalchemy import Column, String, Integer, DateTime, ForeignKey, Text, Index, func
-from sqlalchemy.dialects.postgresql import UUID, JSONB
+
+from sqlalchemy import Column, DateTime, ForeignKey, Index, Integer, String, Text, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.orm import relationship
 
 from app.database import Base