ci: shift-left quality gates — add mypy to pre-commit, fix CI failures (#53)

* ci: shift-left quality gates — add mypy to pre-commit, fix CI failures

- Add mypy pre-commit hook (mirrors-mypy v1.13.0) so type checks run locally
- Add [tool.mypy] config to scripts/pyproject.toml with overrides for untyped libs (ebooklib, sync_translations)
- Add mypy>=1.8.0 to requirements-dev.txt
- Fix CI test.yml: remove continue-on-error: true from lint/security/type-check jobs (was silently swallowing failures)
- Fix CI bandit -c path: pyproject.toml → scripts/pyproject.toml
- Fix CI mypy command: use --config-file scripts/pyproject.toml
- Fix CI build-epub: add type-check to needs, fix if: success() → !failure() && !cancelled()
- Fix ruff errors in sync_translations.py (RUF013 implicit Optional, SIM102 nested if)
- Fix mypy errors: add list[str] annotations to errors vars in check_cross_references.py and check_links.py

* fix(ci): install mmdc in build-epub job and correct return type annotation

- Add npm install step for @mermaid-js/mermaid-cli before Build EPUB
  to fix CI failure (mmdc not found error)
- Fix check_translation_status() return type from list[dict] to
  tuple[list[dict], list[dict]] to match the actual return value

* fix(ci): pass --no-sandbox to Puppeteer in build-epub CI job

mmdc (Mermaid CLI) uses Puppeteer/Chromium which requires --no-sandbox
in the GitHub Actions sandboxed environment. Add --puppeteer-config flag
to build_epub.py that passes a Puppeteer JSON config file to mmdc via -p,
and use it in the CI workflow to inject the no-sandbox args.

scripts/build_epub.py

@@ -123,6 +123,7 @@ class EPUBConfig:
 
     # Local rendering settings
     mmdc_path: str = "mmdc"
+    puppeteer_config: str | None = None
 
     # Font paths (platform-specific)
     title_font_paths: list[str] = field(
@@ -286,16 +287,19 @@ class MermaidRenderer:
             input_file.write_text(mermaid_code, encoding="utf-8")
 
             try:
+                cmd = [
+                    mmdc,
+                    "-i",
+                    str(input_file),
+                    "-o",
+                    str(output_file),
+                    "-b",
+                    "white",
+                ]
+                if self.config.puppeteer_config:
+                    cmd += ["-p", self.config.puppeteer_config]
                 result = subprocess.run(  # nosec B603
-                    [
-                        mmdc,
-                        "-i",
-                        str(input_file),
-                        "-o",
-                        str(output_file),
-                        "-b",
-                        "white",
-                    ],
+                    cmd,
                     capture_output=True,
                     text=True,
                     check=False,
@@ -1056,6 +1060,12 @@ def main() -> int:
         choices=["en", "vi"],
         help="Language code: 'en' for English, 'vi' for Vietnamese (default: en)",
     )
+    parser.add_argument(
+        "--puppeteer-config",
+        type=str,
+        default=None,
+        help="Path to Puppeteer config JSON file passed to mmdc via -p (e.g. for --no-sandbox in CI)",
+    )
 
     args = parser.parse_args()
 
@@ -1085,6 +1095,7 @@ def main() -> int:
         language=language,
         title=title,
         mmdc_path=args.mmdc_path,
+        puppeteer_config=args.puppeteer_config,
     )
 
     try: