Backend runtime upgraded to Python 3.14 with exact dependency pinning (#57)

Signed-off-by: Cliff Hill <xlorep@darkhelm.org>

## Summary

Upgrades backend runtime baseline and dependency management for issue #10.

### Changes

1. **Python Baseline**: Updated from 3.13 to 3.14
   - Updated `backend/pyproject.toml` requires-python constraint
   - Updated `backend/pyrightconfig.json` pythonVersion
   - Updated all Dockerfile and CI references

2. **Dependency Pinning**: Switched to exact version pins in `backend/pyproject.toml`
   - All dev and runtime dependencies now use `==` instead of `>=`
   - `fastapi==0.120.2`, `uvicorn==0.38.0`
   - ruff, pyright, pytest suite pinned to current resolved versions
   - Regenerated `backend/uv.lock` under Python 3.14

3. **Startup Compatibility Guard** (TDD via RED→GREEN)
   - New `compatibility_status()` function evaluates runtime and pinned deps
   - Startup raises `RuntimeError` if policy fails
   - Implemented via FastAPI lifespan (non-deprecated) handler

4. **Compatibility Status Endpoint**
   - New `GET /compatibility` returns policy status, runtime version, and package checks
   - Shares single source of truth with startup validation

5. **Integration Tests**
   - Added failing-then-passing tests for startup guard and endpoint behavior
   - 100% coverage maintained

6. **Direnv Configuration**
   - Added `UV_PYTHON="3.14"` pin to repo `.envrc`
   - Ensures direnv creates/recreates venv with correct Python version

### Validation

- ✅ ruff format/check
- ✅ pyright strict (0 errors)
- ✅ pytest: 8 passed, 100% coverage (>=95 gate)
- ✅ pydoclint: pass
- ✅ xdoctest: pass

### Notes

- SQLAlchemy/SQLModel introduction deferred to next pass per scope
- Compatibility logic currently validates fastapi/uvicorn pins (runtime deps)
- Ready for container build validation and Renovate bot testing

Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: #57
Co-authored-by: Cliff Hill <xlorep@darkhelm.org>
Co-committed-by: Cliff Hill <xlorep@darkhelm.org>

docs/CICD_TROUBLESHOOTING_GUIDE.md

@@ -217,6 +217,31 @@ RUN echo "=== Base Image Optimization Status ===" && \
 
 ## Troubleshooting Playbook
 
+### Missing Immutable Base Image
+
+**Symptom**:
+```
+❌ Required immutable base image is not available: kankali.darkhelm.lan:3001/darkhelm.org/plex-playlist-cicd-base:<hash>
+Publish the base image via the CICD Base Image workflow before rerunning main CI.
+```
+
+**Meaning**: The main CI workflow computed the expected base hash correctly, but the
+dedicated base-image workflow has not published that immutable tag yet.
+
+**Checks**:
+1. Confirm whether `Dockerfile.cicd-base`, `.dockerignore`, or `scripts/compute-cicd-base-hash.sh` changed in the branch.
+2. Check the `CICD Base Image` workflow for the same commit or PR.
+3. Verify the registry contains `plex-playlist-cicd-base:<hash>`.
+
+**Resolution**:
+1. If the base workflow is still running, rerun main CI after it completes.
+2. If the base workflow did not trigger, run it manually with `force_rebuild=false`.
+3. If the tag should be republished despite already existing, run it manually with `force_rebuild=true`.
+
+**Why CI does not self-heal here**: rebuilding the base inside the main workflow would
+make different runners produce and consume different local artifacts, which defeats the
+publish-once/consume-many design.
+
 ### Docker Build Failures
 
 #### 1. rsync Command Not Found