fix: clear ruff so the pre-push gate passes

105 findings to zero. Most were mechanical — 67 unused imports, and assorted
f-strings without placeholders. Three groups needed a decision.

The 15 F821 "undefined name" were forward references, not runtime errors. Each
annotation is quoted — `-> "WikiService"`, `Optional["IngestionService"]` — with
the real import inside the function body to break an import cycle. A quoted
annotation is never evaluated, so the code ran; the names were simply
unresolvable to any checker. They now have a TYPE_CHECKING block, which costs
nothing at import time and keeps the cycle broken.

The 6 E402 split two ways. `import secrets`, `Security`, `Request` and
`HTTPBearer` in dependencies.py had drifted below several hundred lines of
factory functions for no reason — stdlib and fastapi, no cycle to avoid — and
moved up. The other three are deliberate and now say so: the VectorService and
GraphService aliases import back into dependencies.py, and main.py's routers
expect a configured app, so both must stay put.

Bare `except:` narrowed to `except Exception:` in three places, which stops them
swallowing KeyboardInterrupt and SystemExit.

The 5 unused locals were all genuinely dead. One is worth naming rather than
fixing: qdrant_client.delete()'s return value was bound and never read, so a
failed delete is indistinguishable from a successful one — the assignment is
gone, but nothing checks the status either way and that has not changed here.
`timing = {}` in _retrieve_parallel looked like it might mean the reported
per-leg timings were always zero; traced, and they come from output["timing"],
so the local was only vestigial.

426 passed, 29 skipped, unchanged. The app imports and the service aliases still
resolve, which is the check that mattered after moving imports in
dependencies.py.

The gate still prints "not gated here yet: test (T-56)" — lint is green, tests
remain unwired, and that is left visible rather than silently absent.

Co-Authored-By: Claude <noreply@anthropic.com>

src/core/dependencies.py

@@ -9,12 +9,17 @@ Provides FastAPI dependencies for service clients with:
 """
 
 from functools import lru_cache
-from typing import Annotated
+from typing import TYPE_CHECKING, Annotated
 from fastapi import Depends, HTTPException, Query
 import logging
 
 import redis.asyncio as aioredis
 
+import secrets
+
+from fastapi import Request, Security
+from fastapi.security import HTTPBearer
+
 from src.config import Settings, get_settings
 from src.clients.neo4j_client import Neo4jClient
 from src.clients.qdrant_client import QdrantClientWrapper
@@ -764,11 +769,6 @@ def get_volatile_cache_service() -> "VolatileCacheService":
     )
 
 
-# Authentication
-import secrets
-from fastapi import Security, HTTPException, Request
-from fastapi.security import HTTPBearer
-
 security = HTTPBearer()
 
 
@@ -833,10 +833,24 @@ async def verify_browser_request(
     raise HTTPException(status_code=401, detail="Unauthenticated")
 
 
-# Service type aliases for FastAPI endpoint dependencies
-# These are defined after the factory functions
-from src.services.vector_service import VectorService
-from src.services.graph_service import GraphService
+# Service type aliases for FastAPI endpoint dependencies.
+# Deliberately imported here rather than at the top: these modules import back
+# into this one, so a module-level import would cycle. The factory functions
+# above must exist before they are pulled in.
+from src.services.vector_service import VectorService  # noqa: E402
+from src.services.graph_service import GraphService  # noqa: E402
+
+# Imported for annotations only. The real imports live inside the functions
+# that use them, to break an import cycle; a quoted annotation is never
+# evaluated at runtime, so the names were unresolvable to any checker. This
+# block costs nothing at import time and makes them resolvable again.
+if TYPE_CHECKING:
+    from src.services.consolidation_service import ConsolidationService
+    from src.services.hybrid_rag_service import HybridRAGService
+    from src.services.ingestion_service import IngestionService
+    from src.services.rag_search_service import RAGSearchService
+    from src.services.volatile_service import VolatileCacheService
+    from src.services.wiki_service import WikiService
 
 VectorServiceDep = Annotated[VectorService, Depends(get_vector_service)]
 GraphServiceDep = Annotated[GraphService, Depends(get_graph_service)]