fix: resolve all linting errors, add tests, bump base image

Linting (ruff):
- cli.py: sort relative imports (I001)
- jobs.py: remove unused get_people import (F401), wrap long line (E501)
- executor.py: remove unused success variable (F841), wrap 4 long lines (E501)

Tests (24 passing):
- tests/test_config.py: config singleton defaults + env var overrides
- tests/test_upload_tracker.py: mark/filter/reset/summary logic
- tests/test_immich_api.py: filter_recent_assets date boundary cases
- tests/test_jobs.py: _resolve_strategy with LIMIT env var and fallbacks
- pyproject.toml: add [tool.pytest.ini_options] testpaths=["tests"] so
  pytest doesn't scan .venv in CI

Security:
- Dockerfile: bump CUDA base from 12.6.3 to 12.9.2 to pick up patched
  Ubuntu packages (fixes Dependabot low-severity alert)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_config.py

@@ -0,0 +1,80 @@
+"""Smoke tests for configuration loading."""
+
+import os
+
+import pytest
+
+
+def test_config_loads_defaults(monkeypatch):
+    """Config reads env vars and falls back to documented defaults."""
+    monkeypatch.setenv("IMMICH_URL", "http://test:2283")
+    monkeypatch.setenv("API_KEY", "test-key")
+
+    from if_curator.config import _Config
+
+    _Config.reset()
+    cfg = _Config()
+
+    assert cfg.IMMICH_URL == "http://test:2283"
+    assert cfg.API_KEY == "test-key"
+    assert cfg.OUTPUT_DIR == "./frigate_train"
+    assert cfg.YEARS_FILTER == 10
+    assert cfg.MIN_FACE_WIDTH == 50
+    assert cfg.MIN_FACE_COUNT == 0
+    assert cfg.BLUR_THRESHOLD == 100.0
+    assert cfg.MIN_CONFIDENCE == 0.7
+    assert cfg.MAX_AUTO_IMAGES == 80
+    assert cfg.FACE_MARGIN == 0.15
+    assert cfg.USE_FULL_RESOLUTION is True
+    assert cfg.ENABLE_FACE_ALIGNMENT is True
+    assert cfg.ENABLE_CACHE is False
+
+    _Config.reset()
+
+
+def test_config_env_overrides(monkeypatch):
+    """All quality settings are overridable via environment variables."""
+    monkeypatch.setenv("IMMICH_URL", "http://test:2283")
+    monkeypatch.setenv("API_KEY", "test-key")
+    monkeypatch.setenv("YEARS_FILTER", "5")
+    monkeypatch.setenv("MIN_FACE_WIDTH", "80")
+    monkeypatch.setenv("BLUR_THRESHOLD", "50.0")
+    monkeypatch.setenv("MIN_CONFIDENCE", "0.9")
+    monkeypatch.setenv("MAX_AUTO_IMAGES", "40")
+    monkeypatch.setenv("FACE_MARGIN", "0.2")
+    monkeypatch.setenv("USE_FULL_RESOLUTION", "false")
+    monkeypatch.setenv("ENABLE_FACE_ALIGNMENT", "false")
+    monkeypatch.setenv("ENABLE_CACHE", "true")
+
+    from if_curator.config import _Config
+
+    _Config.reset()
+    cfg = _Config()
+
+    assert cfg.YEARS_FILTER == 5
+    assert cfg.MIN_FACE_WIDTH == 80
+    assert cfg.BLUR_THRESHOLD == 50.0
+    assert cfg.MIN_CONFIDENCE == 0.9
+    assert cfg.MAX_AUTO_IMAGES == 40
+    assert cfg.FACE_MARGIN == 0.2
+    assert cfg.USE_FULL_RESOLUTION is False
+    assert cfg.ENABLE_FACE_ALIGNMENT is False
+    assert cfg.ENABLE_CACHE is True
+
+    _Config.reset()
+
+
+def test_get_headers_returns_api_key(monkeypatch):
+    """get_headers() returns the correct auth header dict."""
+    monkeypatch.setenv("IMMICH_URL", "http://test:2283")
+    monkeypatch.setenv("API_KEY", "my-secret-key")
+
+    from if_curator.config import _Config, get_headers
+
+    _Config.reset()
+    headers = get_headers()
+
+    assert headers["x-api-key"] == "my-secret-key"
+    assert headers["Accept"] == "application/json"
+
+    _Config.reset()