chore: engineering hardening - test tooling, lint, security fix, and …

[Marrrrrrrrry]

…cleanup

• add pyproject.toml with pytest config and dev dependency group (PEP 735)
• add ruff (core correctness rules) + pre-commit hook
• fix stored XSS: html.escape site config before index template injection, with regression tests
• log previously swallowed cleanup exceptions in upload rollback paths
• consolidate three duplicate path generators into build_file_path (also aligns chunk/presign date dirs to get_now() instead of local time)
• drop redundant ip_limit sync in load_config (refresh_settings covers all limiters)
• remove dead code (calculate_file_hash, commented-out block), two orphan guide docs, and stale .gitignore entries
• add dependabot for pip, docker, and github-actions
• bump starlette 1.3.1 -> 1.6.0 (no breaking API changes; verified with the full test suite plus an ASGI smoke test incl. Range downloads)
• skip theme asset tests when themes/ is not built locally

[vercel]

@Marrrrrrrrry is attempting to deploy a commit to the vastsa's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Marrrrrrrrry]

我要加入vercel组吗？然后问下最近的迭代计划 我不太喜欢处理分支冲突（我知道ai能做但是怕我们在相同开发位置撞车） 如果你最近有开发计划我就等等再修复/做新功能和pr