Context

Ruff 0.16 enables 413 rules by default, up from 59 in previous versions. We should enable those rules where appropriate while preserving our existing rule set, especially including the "S" security rule set. Full details and verification: https://gist.github.com/blink1073/05b51a7dc689593cd3baa1a67ba083b1

Definition of done

- Ruff pinned to 0.16.0; config updated so the new defaults are adopted with zero loss of currently-enforced rules and bandit fully intact.
- Add support for the datetime rule set; everything else new is suppressed with a follow-up ticket to enable incrementally.
- Lint and typing checks pass clean.

Pitfalls

Ensure we do not lose existing rule set support.
Do not attempt to take on too big of a change in this PR.