chore: ruff clean, validate created_after query param

- tests/test_rbac.py: remove unused args variable in test_manage_py_accepts_viewer_role,
  clean up redundant parse_known_args call
- app.py: validate created_after ISO datetime before passing to SQL; returns 400 on
  malformed input instead of propagating a database error

Author: Romil2112

app.py

@@ -270,6 +270,10 @@ def alert_filters(extra=None):
     # created_after: ISO datetime string (additive param, no existing filter affected)
     created_after = (request.args.get("created_after") or "").strip()
     if created_after:
+        try:
+            datetime.fromisoformat(created_after.replace("Z", "+00:00"))
+        except ValueError:
+            abort(400, description="created_after must be an ISO 8601 datetime")
         where_sql.append("created_at >= %s")
         params.append(created_after)
     sql = (" WHERE " + " AND ".join(where_sql)) if where_sql else ""

tests/test_rbac.py

@@ -339,12 +339,8 @@ def test_created_after_today_includes_just_created_alert():
 # ── manage.py viewer role ─────────────────────────────────────────────────────
 
 def test_manage_py_accepts_viewer_role():
-    import manage
-    # Dry-run: parse the args without actually connecting to DB.
-    args = manage.main.__code__  # just ensure it's importable
-    # More directly: the argparse choices include 'viewer'.
-    parser_ns, _ = __import__("argparse").ArgumentParser().parse_known_args([])
     import argparse
+    import manage  # noqa: F401 — ensure it's importable without connecting to DB
     p = argparse.ArgumentParser()
     p.add_argument("--role", choices=["viewer", "analyst", "admin"], default="analyst")
     ns = p.parse_args(["--role", "viewer"])