CI blocker: pre-commit house-rule hooks + formatters aren't --all-files-clean (blocks #506/#452)

[MartinCastroAlvarez]

Why

#506 adds the server-side lint+test gate (ci.yml) #452/#331 call for — but its backend job runs pre-commit run --all-files (via scripts/lint.sh), and several hooks were only ever exercised on changed files locally. Under --all-files they throw false positives that make the gate red on main from day one, so it can't be merged or made a required check until fixed. (Full trace in the #506 review.) No real security violation is involved — gitleaks passes, there is no @csrf_exempt, and recent_actions.py is correctly scoped.

Fixes

1. no-csrf-exempt (pattern csrf_exempt) — matches the docstrings that explain the rule ("No @csrf_exempt — Django's middleware enforces") across urls.py/create.py/auth.py/… Make it ignore comment/docstring lines, or match the actual decorator (@csrf_exempt) and exclude the explanatory files. There is no real exemption to catch.
2. no-objects-all-in-api (pattern objects\.(all|filter)\() — matches the same rule-explaining docstrings and the legitimate recent_actions.py:67 LogEntry.objects.filter(user__pk=...) (the parity: index 'Recent actions' widget (per-user LogEntry feed) #502 audit-log feed, correctly user-scoped; rule 10 doesn't govern LogEntry). Ignore comment lines and allow LogEntry.objects.* in recent_actions.py.
3. no-partial-tokens — already has an exclude: list for files that document the token-shaped patterns; add the doc/DECISIONS file(s) ci: run the test suites (pytest + frontend) on every PR (#452) #506 introduced that quote the example (ghp_…) to it. gitleaks remains the real secret gate.
4. ruff / ruff-format / black — the auto-fixing pre-commit variants rewrite files under --all-files and report "Failed". The CI path of scripts/lint.sh should invoke them in check mode (ruff format --check, black --check) so they report without mutating.

Security note / scope

.pre-commit-config.yaml + these house-rule hooks ARE the repo's security tooling (the denylist-class checks) → Tier 5, human review. Keep the hooks stricter or equal — the goal is to remove false positives, never to weaken real detection. Add a regression check that pre-commit run --all-files is clean on main so this can't silently rot again.

Acceptance

pre-commit run --all-files (hence scripts/lint.sh and #506's backend job) is green on main, with every house-rule hook still catching a genuine planted violation in a test fixture. Unblocks #506 → #452 → #331.

[MartinCastroAlvarez]

Closing — out of v1 shipping scope for this repo (#544 collapsed it to the React-super-layer). Python lint-gate de-conflict — quality of life, not shipping. The test gate (#506) covers regressions. Lint debt is post-v1.