feat(ci): 代码质量深度加固 - mypy/ruff/vulture 接入

- ruff 替换 flake8：增加 bugbear/pyupgrade/simplify/return 等规则集
  * 自动修复34个问题（未使用import/格式等）
  * 手动修复10个F841未使用变量 + 2个E722裸except
- mypy 类型检查：告警模式接入Validate，不阻断CI
  * 检查范围：apps/api/app + packages核心业务代码
  * 配置：ignore-missing-imports + explicit-package-bases
- vulture 死代码扫描升级：
  * 置信度阈值从80%降到70%，输出更多参考
  * 按size排序，便于人工审查高价值条目
  * 告警模式不阻断CI
- 新增 pyproject.toml：ruff 集中配置
- 修复F841未使用变量（10处）+ E722裸except（2处）

scripts/check_migration_safety.py

@@ -123,7 +123,7 @@ def get_new_migrations_via_diff(diff_target: str) -> List[Path]:
         return [REPO_ROOT / f for f in files]
     except subprocess.CalledProcessError as e:
         print(f"⚠️  git diff 失败（{diff_target}）：{e.stderr.strip()}")
-        print(f"   降级为检查所有迁移文件")
+        print("   降级为检查所有迁移文件")
         return sorted(ALEMBIC_VERSIONS_DIR.glob("*.py"))
 
 

scripts/init_phase4_tasks.py

@@ -10,8 +10,6 @@ import sys
 
 sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding="utf-8")
 
-import json
-from datetime import datetime, timedelta
 
 import requests
 

scripts/init_phase6_tasks.py

@@ -378,17 +378,17 @@ def init_phase6_tasks():
     conn.commit()
     conn.close()
 
-    print(f"\n[SUCCESS] Phase 6 任务初始化完成！")
+    print("\n[SUCCESS] Phase 6 任务初始化完成！")
     print(f"📊 总计 {len(PHASE6_TASKS)} 个任务")
     print(f"✅ 成功创建 {created_count} 个任务")
-    print(f"\n任务分布：")
-    print(f"  Week 1-2: 基础搭建 - 7 个任务")
-    print(f"  Week 3: 认证页面 - 5 个任务")
-    print(f"  Week 4: 工作空间管理 - 6 个任务")
-    print(f"  Week 5: 订阅管理 - 5 个任务")
-    print(f"  Week 6: Admin 后台 - 5 个任务")
-    print(f"  Week 7: 个人中心 - 4 个任务")
-    print(f"  Week 8: 测试和优化 - 8 个任务")
+    print("\n任务分布：")
+    print("  Week 1-2: 基础搭建 - 7 个任务")
+    print("  Week 3: 认证页面 - 5 个任务")
+    print("  Week 4: 工作空间管理 - 6 个任务")
+    print("  Week 5: 订阅管理 - 5 个任务")
+    print("  Week 6: Admin 后台 - 5 个任务")
+    print("  Week 7: 个人中心 - 4 个任务")
+    print("  Week 8: 测试和优化 - 8 个任务")
     print(f"\n预计总工时：{sum(t['estimated_hours'] for t in PHASE6_TASKS)} 小时")
 
 

scripts/init_tracker_data.py

@@ -10,8 +10,6 @@ import sys
 
 sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding="utf-8")
 
-import json
-from datetime import datetime, timedelta
 
 import requests
 
@@ -294,8 +292,8 @@ def main():
     print("\n" + "=" * 60)
     print("[OK] 数据初始化完成！")
     print("=" * 60)
-    print(f"\n访问推进器: http://47.98.113.167:8088/projects")
-    print(f"访问 API 文档: http://47.98.113.167:8089/docs\n")
+    print("\n访问推进器: http://47.98.113.167:8088/projects")
+    print("访问 API 文档: http://47.98.113.167:8089/docs\n")
 
 
 if __name__ == "__main__":

scripts/init_tracker_direct.py

@@ -35,7 +35,7 @@ def init_database():
     """,
         ("认证与账号体系", "Phase 4", "2026-06-10", "2026-06-17", "completed", "JWT 登录、注册、密码管理"),
     )
-    milestone1_id = cursor.lastrowid
+    _milestone1_id = cursor.lastrowid
 
     auth_tasks = [
         ("JWT 工具类实现", "sign/verify/refresh Token 功能", "completed", "high"),

scripts/smoke_public_boundary_flow.py

@@ -44,7 +44,7 @@ def main() -> None:
     owner_headers = _register_login(owner, "owner")
     intruder_headers = _register_login(intruder, "intruder")
 
-    workspace = _json_or_raise(
+    _workspace = _json_or_raise(
         "owner_workspace",
         owner.post(f"{BASE_URL}/workspaces", json={"name": "Boundary Workspace"}, headers=owner_headers, timeout=30),
     )

scripts/smoke_public_upload_flow.py

@@ -47,7 +47,7 @@ def main() -> None:
     )
     headers = {"Authorization": f"Bearer {login['access_token']}"}
 
-    workspace = _json_or_raise(
+    _workspace = _json_or_raise(
         "workspace",
         session.post(f"{BASE_URL}/workspaces", json={"name": "Upload Smoke Workspace"}, headers=headers, timeout=30),
     )
@@ -75,7 +75,7 @@ def main() -> None:
             timeout=30,
         ),
     )
-    library_id = library["id"]
+    _library_id = library["id"]
 
     upload = _json_or_raise(
         "upload",

scripts/smoke_test.py

@@ -67,7 +67,7 @@ def make_request(base_url, endpoint, token=None):
         body = ""
         try:
             body = e.read().decode()[:200]
-        except:
+        except Exception:
             logger.warning(f"Operation failed in scripts/smoke_test.py: {e}", exc_info=True)
         return {"status": e.code, "elapsed_ms": elapsed, "body": body, "error": None}
     except Exception as e:
@@ -85,7 +85,7 @@ def login(base_url, email, password):
         resp = urllib.request.urlopen(req, timeout=10, context=ctx)
         body = json.loads(resp.read().decode())
         return body.get("token") or body.get("data", {}).get("token") or body.get("access_token")
-    except:
+    except Exception:
         return None