feat(M1): échafaudage et outillage complétés

- .pre-commit-config.yaml : hooks ruff, mypy, bandit, detect-secrets, whitespace
- .secrets.baseline : baseline detect-secrets (faux positif GUIDE_DEV_PYTHON.md)
- pyproject.toml : migration clés ruff vers [tool.ruff.lint], exclusion guide du format
- pip install -e ".[dev]" : dépendances installées dans le venv
- pre-commit install : hook git installé
- TODO.md : items M1 cochés

Validations :
- ruff check . : PASS
- ruff format --check . : PASS
- mypy . : PASS (17 fichiers)
- pytest : PASS (0 test, infrastructure OK)
- bandit -r pronote_sync/ : PASS
- pre-commit run --all-files : 9 passed, 1 skipped, 0 failed
- import pronote_sync : OK

Co-authored-by: OpenCode/orchestrator <opencode-orchestrator@agents.invalid>

.pre-commit-config.yaml

@@ -0,0 +1,60 @@
+# Hooks pre-commit pour pronote-sync
+# Installation : pre-commit install
+# Exécution manuelle : pre-commit run --all-files
+default_language_version:
+  python: python3
+
+repos:
+  # Outils du venv (ruff, mypy, bandit) — exécutés dans l'environnement géré par pre-commit
+  - repo: local
+    hooks:
+      - id: ruff-check
+        name: ruff check
+        entry: ruff check
+        language: python
+        additional_dependencies: ["ruff>=0.4.0"]
+        types: [python]
+
+      - id: ruff-format
+        name: ruff format
+        entry: ruff format
+        language: python
+        additional_dependencies: ["ruff>=0.4.0"]
+        types: [python]
+
+      - id: mypy
+        name: mypy
+        entry: mypy
+        language: python
+        additional_dependencies: ["mypy>=1.10.0"]
+        types: [python]
+        pass_filenames: true
+
+      - id: bandit
+        name: bandit
+        entry: bandit
+        args: [-c, pyproject.toml, -r]
+        language: python
+        additional_dependencies: ["bandit>=1.7.0"]
+        types: [python]
+
+  # Hooks standard de pre-commit
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+        exclude: 'GUIDE_DEV_PYTHON\.md'
+      - id: end-of-file-fixer
+        exclude: 'GUIDE_DEV_PYTHON\.md'
+      - id: check-yaml
+      - id: check-added-large-files
+        args: [--maxkb=500]
+        exclude: 'GUIDE_DEV_PYTHON\.md'
+      - id: check-merge-conflict
+
+  # Détection de secrets
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.5.0
+    hooks:
+      - id: detect-secrets
+        args: [--baseline, .secrets.baseline]