fix(dashboard): restore isort-clean import order in the dashboard auth module

[iamwhatever]

Problem

Backend Lint & Type Check fails on origin/main itself, at the Check imports (isort)
step:

ERROR: src/kiro_crew/dashboard/token_auth.py Imports are incorrectly sorted and/or formatted.

Because the job is a matrix, the 3.12 failure cancels 3.10, so the check reports two
red entries. It red-lights every open PR regardless of what that PR changes.

Why it matters

A base breakage on a blocking lint step makes every PR look broken and buries real
findings — the author's first move is to hunt for a fault in their own diff that is not
there.

Fix (symptoms → root cause → change)

Symptom: isort fails on a file no open PR touches.
Root cause: d2e1109f9 (#2388) added a kiro_crew.dashboard.tailnet import block
above the revocation_gen block, which is out of alphabetical order for that section.
Change: run isort on the file, which moves the tailnet block below revocation_gen.
Import statements only — no logic, no behaviour.

The two neighbouring blocks carry comments explaining that they exist to break a
token_auth ↔ refresh_tokens import cycle. Each comment still sits directly above the
block it describes after the move, and the reordering cannot reintroduce a cycle:
tailnet does not import this module (its only in-repo imports are dashboard.urls,
executors, platform.governance_profiles, platform_compat and sandbox), so its
position among the absolute imports is inert at import time.

Tests

No new tests — this is an import-ordering fix on a lint-only failure, and isort itself is
the assertion. Verified on a clean worktree off main (584bbb05f):

• isort --check-only src/kiro_crew test → exit 0 (was exit 1)
• flake8 src/kiro_crew test → exit 0

Manual verification

N/A — the failing CI step is the verification, and it is deterministic. Import ordering
carries no runtime behaviour beyond module-load order, which is addressed above.

[github-actions]

Opus 4.8 Review — ✅ no blocking findings

Reviewed 925d5fa056487dd110380890debdfbaa8b5c1456 — this comment is updated in place on each push.

Review details

The diff is a pure import-block reorder: the tailnet import moves from above the revocation_gen block to below it. The comment on lines 43–48 describes revocation_gen and still sits directly above it; no comment was orphaned. The moved names were used before and remain used (F401 is tool-owned regardless). No module-load-order behavior changes, and the reorder cannot introduce a cycle since tailnet doesn't import token_auth.

No findings.

[OPUS-REVIEWED] 925d5fa

Verdict parsed from the review's SHA-scoped output markers for commit 925d5fa056487dd110380890debdfbaa8b5c1456.

False positive or not applicable? A repository writer can comment:
/ai-review override fable 925d5fa056487dd110380890debdfbaa8b5c1456: <one-sentence reason>

[github-actions]

GPT 5.6 Review — ✅ no blocking findings

GPT 5.6 completed its review of 925d5fa056487dd110380890debdfbaa8b5c1456 and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] 925d5fa

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 925d5fa056487dd110380890debdfbaa8b5c1456: <one-sentence reason>

[github-actions]

Design Review (Fable 5) — ✅ PASS

Advisory design-level review of 925d5fa056487dd110380890debdfbaa8b5c1456 — updated in place on each push; does not block merge.

The diff is a pure import reorder in one file — tailnet block moved below revocation_gen to restore alphabetical order, with the cycle-breaking comments still attached to their blocks. The verification is confirmed by inspection: resulting order is origin → refresh_tokens → revocation_gen → tailnet → token_secret, which is isort-clean, and the description's claim that tailnet has no import-cycle exposure is consistent with the code. No behavior, API, or data changes; nothing undocumented in the diff.

Design-Verdict: PASS

Mechanical one-file isort fix that unbreaks a base-branch lint failure; zero behavior change, comments stay attached to their blocks.

[DESIGN-REVIEWED] 925d5fa