Fix the CI gates: Python 3.13, concurrency groups, hook violations

The gates have never gone green on the new runners. Three separate reasons:

- backend/Dockerfile shipped Python 3.10 while the code imports typing.Self
  and datetime.UTC, so the container exited on import and the suite could not
  even load its conftest. The image moves to 3.13 and the packages declare
  >=3.12, which is the floor the tests actually pass on; ruff's target follows
  and rewrites timezone.utc and asyncio.TimeoutError accordingly. Relocking
  drops the 3.10 branch, which bumps FastAPI and so regenerates the SDK.
- frontend/README.md had no trailing newline and two dashboard widgets used
  arbitrary text-[…] sizes. Both are em-relative on purpose, so they move to
  the inline style the neighbouring ramp already uses.
- Every commit left its own run queued: without a concurrency group a runner
  that was offline for a while works through a backlog nobody reads. A stack
  that fails to come up now prints its logs before the teardown removes it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/docs.yml

@@ -9,6 +9,13 @@ on:
       - opened
       - synchronize
 
+# A new push supersedes the run still queued for the commit before it. Without
+# this each commit leaves its own run in the queue and a runner that was offline
+# for a while works through a backlog of results nobody will read.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   docs:
     runs-on: ubuntu-latest

.gitea/workflows/playwright.yml

@@ -21,6 +21,13 @@ on:
       - .env.example
       - .gitea/workflows/playwright.yml
 
+# A new push supersedes the run still queued for the commit before it. Without
+# this each commit leaves its own run in the queue and a runner that was offline
+# for a while works through a backlog of results nobody will read.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   # The playwright runner service comes from the dev overlay. It loads the SPA
   # from the nginx `frontend` service and reaches the API as http://backend:8000

.gitea/workflows/pre-commit.yml

@@ -11,6 +11,13 @@ on:
       - opened
       - synchronize
 
+# A new push supersedes the run still queued for the commit before it. Without
+# this each commit leaves its own run in the queue and a runner that was offline
+# for a while works through a backlog of results nobody will read.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
@@ -23,7 +30,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: "3.13"
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
         with:

.gitea/workflows/publish.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: "3.13"
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
       - name: The tag is what the packages say they are

.gitea/workflows/test-backend.yml

@@ -9,6 +9,13 @@ on:
       - opened
       - synchronize
 
+# A new push supersedes the run still queued for the commit before it. Without
+# this each commit leaves its own run in the queue and a runner that was offline
+# for a while works through a backlog of results nobody will read.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   # The compose files live in docker/, so a bare `docker compose` from the repo
   # root finds nothing. With COMPOSE_FILE set, compose reads .env from the
@@ -31,7 +38,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: "3.13"
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
         with:

.gitea/workflows/test-compose.yml

@@ -25,6 +25,13 @@ on:
       - .env.example
       - .gitea/workflows/test-compose.yml
 
+# A new push supersedes the run still queued for the commit before it. Without
+# this each commit leaves its own run in the queue and a runner that was offline
+# for a while works through a backlog of results nobody will read.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   # compose.ci.yml drops the fixed container_names and host ports so this job
   # can share a runner host with the Playwright shards.
@@ -59,6 +66,12 @@ jobs:
         run: docker compose exec -T backend curl -f http://frontend/
       - name: An authenticated route serves the SPA shell
         run: docker compose exec -T backend curl -f http://frontend/flows
+      - name: Container logs
+        # `up --wait` reports only that a container exited, never why. Without
+        # this the whole failure is one line and the reason dies with the stack
+        # the teardown below removes.
+        if: failure()
+        run: docker compose logs --no-color --tail 200
       - name: Tear down
         if: always()
         run: docker compose down -v --remove-orphans