Fix the CI gates: Python 3.13, concurrency groups, hook violations

The gates have never gone green on the new runners. Three separate reasons:

- backend/Dockerfile shipped Python 3.10 while the code imports typing.Self
  and datetime.UTC, so the container exited on import and the suite could not
  even load its conftest. The image moves to 3.13 and the packages declare
  >=3.12, which is the floor the tests actually pass on; ruff's target follows
  and rewrites timezone.utc and asyncio.TimeoutError accordingly. Relocking
  drops the 3.10 branch, which bumps FastAPI and so regenerates the SDK.
- frontend/README.md had no trailing newline and two dashboard widgets used
  arbitrary text-[…] sizes. Both are em-relative on purpose, so they move to
  the inline style the neighbouring ramp already uses.
- Every commit left its own run queued: without a concurrency group a runner
  that was offline for a while works through a backlog nobody reads. A stack
  that fails to come up now prints its logs before the teardown removes it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/fluksio/api/routes/oauth.py

@@ -27,7 +27,7 @@ import secrets
 import time
 import uuid
 from collections import defaultdict, deque
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from typing import Any
 from urllib.parse import urlencode, urlparse
 
@@ -125,12 +125,12 @@ def _valid_redirect_uri(value: str) -> bool:
 
 
 def _now() -> datetime:
-    return datetime.now(timezone.utc)
+    return datetime.now(UTC)
 
 
 def _aware(value: datetime) -> datetime:
     """Postgres hands back naive datetimes; compare them in UTC."""
-    return value if value.tzinfo else value.replace(tzinfo=timezone.utc)
+    return value if value.tzinfo else value.replace(tzinfo=UTC)
 
 
 def _prune(session: SessionDep) -> None:

backend/fluksio/api/routes/observability.py

@@ -7,7 +7,7 @@ which the generated SDK turns into a thrown error — and a health page that
 cannot render while the engine is degraded is the wrong way round.
 """
 
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from typing import Any, Literal
 
 from fastapi import APIRouter, Depends, Request
@@ -110,7 +110,7 @@ class DeadLetter(BaseModel):
 
 
 def _since(hours: int) -> datetime:
-    return datetime.now(timezone.utc) - timedelta(hours=hours)
+    return datetime.now(UTC) - timedelta(hours=hours)
 
 
 def _window_hours(hours: int) -> int:
@@ -124,7 +124,7 @@ def _window_hours(hours: int) -> int:
 
 def _aware(when: datetime) -> datetime:
     """A bound as the columns store it. A naive one is read as UTC."""
-    return when if when.tzinfo else when.replace(tzinfo=timezone.utc)
+    return when if when.tzinfo else when.replace(tzinfo=UTC)
 
 
 @router.get("/summary", response_model=HealthSummary)

backend/fluksio/api/routes/workers.py

@@ -124,7 +124,7 @@ async def attach(websocket: WebSocket, token: str = "") -> None:
     await websocket.accept()
     try:
         hello = await asyncio.wait_for(websocket.receive_json(), timeout=30)
-    except (TimeoutError, asyncio.TimeoutError, ValueError):
+    except (TimeoutError, ValueError):
         await websocket.close(code=1002)
         return