Fix the CI gates: Python 3.13, concurrency groups, hook violations

The gates have never gone green on the new runners. Three separate reasons:

- backend/Dockerfile shipped Python 3.10 while the code imports typing.Self
  and datetime.UTC, so the container exited on import and the suite could not
  even load its conftest. The image moves to 3.13 and the packages declare
  >=3.12, which is the floor the tests actually pass on; ruff's target follows
  and rewrites timezone.utc and asyncio.TimeoutError accordingly. Relocking
  drops the 3.10 branch, which bumps FastAPI and so regenerates the SDK.
- frontend/README.md had no trailing newline and two dashboard widgets used
  arbitrary text-[…] sizes. Both are em-relative on purpose, so they move to
  the inline style the neighbouring ramp already uses.
- Every commit left its own run queued: without a concurrency group a runner
  that was offline for a while works through a backlog nobody reads. A stack
  that fails to come up now prints its logs before the teardown removes it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/tests/api/routes/test_observability.py

@@ -1,4 +1,4 @@
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 
 from fastapi.testclient import TestClient
 from sqlmodel import Session
@@ -11,7 +11,7 @@ FLOW = "observability-test"
 
 
 def _seed(db: Session) -> None:
-    now = datetime.now(timezone.utc).replace(second=0, microsecond=0)
+    now = datetime.now(UTC).replace(second=0, microsecond=0)
     db.add(
         MetricBucket(
             flow=FLOW,
@@ -170,8 +170,8 @@ def test_the_timeseries_folds_into_the_requested_bucket(
     flow = "bucket-fold-test"
     # The start of the current quarter hour, half an hour back so both slices
     # sit inside a one hour window.
-    now = datetime.now(timezone.utc).timestamp()
-    first = datetime.fromtimestamp(now // 900 * 900 - 1800, timezone.utc)
+    now = datetime.now(UTC).timestamp()
+    first = datetime.fromtimestamp(now // 900 * 900 - 1800, UTC)
     for offset, executions in ((0, 1), (2, 2), (5, 4), (15, 8)):
         db.add(
             MetricBucket(
@@ -210,9 +210,7 @@ def test_the_runs_page_carries_its_total(
     client: TestClient, superuser_token_headers: dict[str, str], db: Session
 ) -> None:
     """A full page says how much it left behind."""
-    minute = datetime.now(timezone.utc).replace(second=0, microsecond=0) - timedelta(
-        hours=5
-    )
+    minute = datetime.now(UTC).replace(second=0, microsecond=0) - timedelta(hours=5)
     for index in range(3):
         db.add(
             FlowRun(
@@ -242,9 +240,7 @@ def test_runs_narrow_to_one_minute(
     client: TestClient, superuser_token_headers: dict[str, str], db: Session
 ) -> None:
     """A minute picked off a chart reaches past what the recent list holds."""
-    minute = datetime.now(timezone.utc).replace(second=0, microsecond=0) - timedelta(
-        hours=3
-    )
+    minute = datetime.now(UTC).replace(second=0, microsecond=0) - timedelta(hours=3)
     db.add(FlowRun(id="minute-in", flow=FLOW, started_at=minute, status="ok"))
     db.add(
         FlowRun(
@@ -274,9 +270,7 @@ def test_events_narrow_to_one_minute(
     client: TestClient, superuser_token_headers: dict[str, str], db: Session
 ) -> None:
     """The failures list reaches as far back as the charts beside it."""
-    minute = datetime.now(timezone.utc).replace(second=0, microsecond=0) - timedelta(
-        hours=4
-    )
+    minute = datetime.now(UTC).replace(second=0, microsecond=0) - timedelta(hours=4)
     db.add(EngineEvent(ts=minute, type="node_error", flow=FLOW, detail="minute-in"))
     db.add(
         EngineEvent(

backend/tests/test_db.py

@@ -1,6 +1,6 @@
 """What the database has to keep true whatever dialect is under it."""
 
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta, timezone
 
 from sqlmodel import Session, select
 
@@ -30,4 +30,4 @@ def test_a_stored_instant_comes_back_aware_and_in_utc() -> None:
         assert stored.ts.utcoffset() == timedelta(0)
         assert stored.ts == stamp
         # And it still compares against an aware "now" rather than raising.
-        assert stored.ts < datetime.now(timezone.utc)
+        assert stored.ts < datetime.now(UTC)

backend/tests/test_metrics.py

@@ -6,7 +6,7 @@ the database, and writing to it is this module's whole job.
 
 import asyncio
 import time
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 from sqlmodel import Session, select
 
@@ -71,7 +71,7 @@ def test_events_become_rollups_failures_runs_and_audit(db: Session) -> None:
     collector = MetricsCollector(EventBus())
     # The current minute, pinned: the second flush has to land in the same
     # bucket, and anything past the retention window is pruned on write.
-    ts = datetime.now(timezone.utc).replace(second=0, microsecond=0).timestamp()
+    ts = datetime.now(UTC).replace(second=0, microsecond=0).timestamp()
     _events(collector, ts, "1-0")
     collector.handle(
         {
@@ -130,7 +130,7 @@ def test_a_flush_the_database_refused_is_written_by_the_next_one(
     db: Session, monkeypatch
 ) -> None:
     collector = MetricsCollector(EventBus())
-    ts = datetime.now(timezone.utc).replace(second=0, microsecond=0).timestamp()
+    ts = datetime.now(UTC).replace(second=0, microsecond=0).timestamp()
     collector.handle(
         {
             "type": "audit",
@@ -157,7 +157,7 @@ def test_a_flush_the_database_refused_is_written_by_the_next_one(
 
 def test_a_node_id_wider_than_the_column_still_records(db: Session) -> None:
     collector = MetricsCollector(EventBus())
-    ts = datetime.now(timezone.utc).replace(second=0, microsecond=0).timestamp()
+    ts = datetime.now(UTC).replace(second=0, microsecond=0).timestamp()
     long_node = f"{FLOW}.{'w' * 400}"
     collector.handle(
         {