refactor(pep8): enforce full PEP8 compliance across backend Python codebase

- ruff.toml: select E/W/F/I/N rules, line-length=120, drop legacy ignores
- Auto-fix: sort 82 import blocks (isort), remove 29 unused imports,
  strip 6 trailing-whitespace blank lines in docstrings
- main.py: move setup_logging and settings imports to top (E402)
- errors.py: noqa N818 on DDD exception names (96 call sites, safe)
- intel_service.py: noqa N817 for universal ET alias
- atomic/elastic/sigma import services: move _MAX_UNCOMPRESSED_SIZE and
  _MAX_ENTRIES to module level (N806)
- compliance_import_service.py: move SAMPLE_CONTROLS / CIS_CONTROLS to
  module level; wrap long description strings (N806 + E501)
- snapshot_service.py: move STATUS_ORDER dict to module level (N806)
- sigma_import_service.py: remove dead dedup_key expression (F841)
- threat_actor_import_service.py: remove dead stix_to_actor expression (F841)
- data_source.py, seed_demo.py, campaign_scheduler_service.py,
  lolbas_import_service.py: wrap lines exceeding 120 chars (E501)
- d3fend_import_service.py: per-file E501 ignore (data file with long strings)

All 439 unit tests pass. ruff check app/ → All checks passed!

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/seed_demo.py

@@ -18,14 +18,14 @@ from datetime import datetime, timedelta
 
 from app.auth import hash_password
 from app.database import SessionLocal
-from app.models.user import User
+from app.models.audit import AuditLog
+from app.models.enums import TeamSide, TechniqueStatus, TestResult, TestState
+from app.models.evidence import Evidence
+from app.models.notification import Notification
 from app.models.technique import Technique
 from app.models.test import Test
 from app.models.test_template import TestTemplate
-from app.models.evidence import Evidence
-from app.models.audit import AuditLog
-from app.models.notification import Notification
-from app.models.enums import TechniqueStatus, TestState, TestResult, TeamSide
+from app.models.user import User
 
 logger = logging.getLogger(__name__)
 
@@ -214,7 +214,11 @@ def _seed_tests(db, users: list[User], techniques: list[Technique], count: int =
             name=f"Demo Test {i + 1} — {technique.name[:40]}",
             description=f"Automated demo test #{i + 1} for {technique.mitre_id}.",
             platform=random.choice(PLATFORMS),
-            procedure_text=f"Step 1: Prepare environment.\nStep 2: Execute {technique.mitre_id} procedure.\nStep 3: Observe results.",
+            procedure_text=(
+                f"Step 1: Prepare environment.\n"
+                f"Step 2: Execute {technique.mitre_id} procedure.\n"
+                f"Step 3: Observe results."
+            ),
             tool_used=random.choice(["powershell", "bash", "cmd", "python", "caldera", "metasploit"]),
             execution_date=datetime.utcnow() - timedelta(days=random.randint(0, 60)),
             created_by=creator.id,
@@ -353,7 +357,11 @@ def _seed_templates(db, techniques: list[Technique], count: int = 10) -> None:
             description=f"Demo template: {name}. Targets {technique.mitre_id} ({technique.name}).",
             source="demo",
             source_url=None,
-            attack_procedure=f"1. Set up environment for {technique.mitre_id}.\n2. Execute the procedure.\n3. Record observations.",
+            attack_procedure=(
+                f"1. Set up environment for {technique.mitre_id}.\n"
+                "2. Execute the procedure.\n"
+                "3. Record observations."
+            ),
             expected_detection=f"SIEM should alert on {technique.mitre_id} indicators.",
             platform=random.choice(PLATFORMS),
             tool_suggested=random.choice(["powershell", "cmd", "bash", "python"]),