Rewrite CI to lint/typecheck/audit/test only; add HPC deployment path

- Replace the Docker build/publish CI stages with ruff (lint + format
  check), ty (type check), pip-audit, and pytest run directly against
  python:3.11-slim; Docker remains for manual/server deployment only.
- Swap black/pylint/mypy for ruff/ty across pyproject.toml, and fix
  every resulting lint, format, and type diagnostic in gallery/ and
  plotstyle/.
- Fix tests broken/stale from before the package restructuring: wrong
  `utils.*` import paths, mock patch targets pointed at the wrong
  module, and PDF-conversion tests still assuming ImageMagick instead
  of the current PyMuPDF-first path. Drop test_container.py (obsolete
  Docker-container smoke tests, fully superseded elsewhere).
- Add a plain-venv + systemd --user timer deployment path
  (deploy/systemd/) for HPC login nodes without a Docker daemon, where
  public_html is already served by existing infrastructure.
- Document both in CLAUDE.md, including running CI's checks locally
  before committing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

gallery/utils/metadata.py

@@ -13,9 +13,10 @@ Features:
 """
 
 import json
-import yaml
 from pathlib import Path
-from typing import Dict, Any
+from typing import Any, Dict
+
+import yaml
 
 
 def load_metadata_file(metadata_path: Path) -> Dict[str, Any]:
@@ -33,15 +34,14 @@ def load_metadata_file(metadata_path: Path) -> Dict[str, Any]:
         return {}
 
     try:
-        with metadata_path.open('r', encoding='utf-8') as f:
+        with metadata_path.open("r", encoding="utf-8") as f:
             suffix_lower = metadata_path.suffix.lower()
-            if suffix_lower == '.yaml' or suffix_lower == '.yml':
+            if suffix_lower == ".yaml" or suffix_lower == ".yml":
                 return yaml.safe_load(f) or {}
-            elif metadata_path.suffix.lower() == '.json':
+            elif metadata_path.suffix.lower() == ".json":
                 return json.load(f) or {}
             else:
-                print(f"Warning: Unknown metadata file format: "
-                      f"{metadata_path}")
+                print(f"Warning: Unknown metadata file format: {metadata_path}")
                 return {}
     except (yaml.YAMLError, json.JSONDecodeError, IOError) as e:
         print(f"Warning: Could not parse metadata file {metadata_path}: {e}")
@@ -59,7 +59,7 @@ def load_folder_metadata(folder_path: Path) -> Dict[str, Any]:
         Dictionary containing the folder metadata
     """
     # Try YAML first, then JSON for backwards compatibility
-    for filename in ['metadata.yaml', 'metadata.yml', 'metadata.json']:
+    for filename in ["metadata.yaml", "metadata.yml", "metadata.json"]:
         metadata_path = folder_path / filename
 
         if metadata_path.exists():
@@ -81,7 +81,7 @@ def get_metadata_file_path(folder_path: Path) -> str:
         String path to the metadata file (existing or suggested)
     """
     # Preferred order: YAML first, then JSON
-    preferred_files = ['metadata.yaml', 'metadata.yml', 'metadata.json']
+    preferred_files = ["metadata.yaml", "metadata.yml", "metadata.json"]
 
     for filename in preferred_files:
         metadata_path = folder_path / filename
@@ -89,13 +89,10 @@ def get_metadata_file_path(folder_path: Path) -> str:
             return str(metadata_path)
 
     # If no file exists, suggest metadata.yaml (preferred format)
-    return str(folder_path / 'metadata.yaml')
+    return str(folder_path / "metadata.yaml")
 
 
-def merge_metadata(
-    parent_metadata: Dict[str, Any],
-    child_metadata: Dict[str, Any]
-) -> Dict[str, Any]:
+def merge_metadata(parent_metadata: Dict[str, Any], child_metadata: Dict[str, Any]) -> Dict[str, Any]:
     """
     Merge parent and child metadata, with child values overriding parent.
 
@@ -111,10 +108,7 @@ def merge_metadata(
     return merged
 
 
-def resolve_metadata_for_plot(
-    plot_path: Path,
-    inherited_metadata: Dict[str, Any]
-) -> Dict[str, Any]:
+def resolve_metadata_for_plot(plot_path: Path, inherited_metadata: Dict[str, Any]) -> Dict[str, Any]:
     """
     Resolve metadata for a specific plot.
 
@@ -131,7 +125,7 @@ def resolve_metadata_for_plot(
     plot_dir = plot_path.parent
 
     # Check for plot-specific metadata files
-    for suffix in ['.yaml', '.yml', '.json']:
+    for suffix in [".yaml", ".yml", ".json"]:
         plot_metadata_path = plot_dir / f"{plot_stem}{suffix}"
         if plot_metadata_path.exists():
             plot_metadata = load_metadata_file(plot_metadata_path)
@@ -141,10 +135,7 @@ def resolve_metadata_for_plot(
     return inherited_metadata.copy()
 
 
-def save_metadata_cache(
-    web_dir: Path,
-    plot_metadata_cache: Dict[str, Dict[str, Any]]
-) -> None:
+def save_metadata_cache(web_dir: Path, plot_metadata_cache: Dict[str, Dict[str, Any]]) -> None:
     """
     Save plot metadata cache to meta_cache.json in the web directory.
 
@@ -154,7 +145,7 @@ def save_metadata_cache(
     """
     cache_path = web_dir / "meta_cache.json"
     try:
-        with cache_path.open('w', encoding='utf-8') as f:
+        with cache_path.open("w", encoding="utf-8") as f:
             json.dump(plot_metadata_cache, f, indent=2, ensure_ascii=False)
     except IOError as e:
         print(f"Warning: Could not save metadata cache {cache_path}: {e}")