Wire the live-test gate and pin the toolchain to 3.14

README advertised `uv run pytest -m live --live`, but there was no --live
option and no `live` marker registered — the command errored out, so the
one workflow that catches an upstream renaming a series did not exist.

- conftest adds --live and skips `live`-marked tests without it, so the
  default run stays hermetic (258 passed, 6 skipped, no network).
- tests/test_live_fleet.py drives the real code paths (collectors.*,
  NutMonitor.collect) against the fleet, both engines, and upsd. Each
  skips when its source is unset, and none of them may write — a battery
  test on live hardware is not a unit test. The host test polls twice
  because a rate has no second point on the first scrape.
- The agent's real-/proc test stays in the default run and is explicitly
  not `live`: it touches only the box running pytest.
- dev-tunnels.sh grows DEV_FORWARDS for services already listening
  remotely, which is how upsd gets reachable without opening 3493;
  pidfiles are now host+port so one host can carry two tunnels.
- requires-python, ruff and pyright were still on 3.13 while the venv and
  Containerfile are 3.14, so the lock resolved for a stack nobody deploys.

LLM-Generated: true

pyproject.toml

@@ -3,7 +3,10 @@ name = "dashboards"
 version = "0.1.0"
 description = "Homelab dashboards on one domain: system resources, LLM engines, and UPS battery health"
 readme = "README.md"
-requires-python = ">=3.13"
+# 3.14 is what the Containerfile, the venv, and the fleet agent's tests run on. The floor
+# is deliberately hard: 3.13 would resolve a different lock and CI would test a stack nobody
+# deploys.
+requires-python = ">=3.14"
 # Deliberately small. Everything we collect is either our own agent's JSON (stdlib only,
 # see agent/host_agent.py) or an upstream Prometheus exposition parsed by our own parser
 # (src/dashboards/prom.py). No prometheus_client, no Grafana, no CDN, no bundler.
@@ -40,6 +43,11 @@ packages = ["src/dashboards"]
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 addopts = "-q --strict-markers"
+markers = [
+    # `-m live --live` runs them; without --live they SKIP, so `uv run pytest` stays
+    # network-free. See tests/test_live_fleet.py for the env vars each one needs.
+    "live: needs real hardware (fleet hosts, LLM engines, or upsd) — opt in with --live",
+]
 # auto: async tests run without a decorator on every single one
 asyncio_mode = "auto"
 filterwarnings = ["error::DeprecationWarning"]
@@ -54,7 +62,7 @@ skip_covered = false
 
 [tool.ruff]
 line-length = 110
-target-version = "py313"
+target-version = "py314"
 src = ["src", "tests", "agent"]
 
 [tool.ruff.lint]
@@ -67,5 +75,5 @@ ignore = ["E501"]
 
 [tool.pyright]
 include = ["src", "tests"]
-pythonVersion = "3.13"
+pythonVersion = "3.14"
 typeCheckingMode = "standard"