ci: pin Python 3.14 and stop depending on the runner's environment

Three failures, all from the workflow inheriting whatever the runner
happened to have rather than declaring what it needs.

- backend ran pytest without installing it. pytest is in
  requirements-dev.txt, which nothing installed, so the step died with
  "No module named pytest".
- Both Python jobs used the runner's system interpreter. The old host
  executor had a matching Python by accident; a container image has
  3.10, where alembic additionally requires tomli. requirements.txt is
  hash-pinned and compiled on 3.14, so tomli has no hash and pip refuses
  the whole install under --require-hashes. 3.14 matches the Dockerfile,
  the README and the .github workflow.
- The utf8mb4 step shelled out to the mysql client, which is not in
  every runner image. pymysql is already a runtime dependency.

.gitea/workflows/ci.yml

@@ -31,12 +31,23 @@ jobs:
     steps:
       - name: Check out
         uses: actions/checkout@v4
+      - name: Set up Python
+        # Pin the interpreter instead of inheriting the runner image's default.
+        # requirements.txt is hash-pinned and was compiled on 3.14; on an older
+        # Python, alembic additionally requires tomli, which has no hash in the
+        # lock file and pip then refuses the whole install.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
       - name: Install dependencies
         run: |
           python3 --version
           python3 -m venv .venv
           .venv/bin/pip install --upgrade pip
           .venv/bin/pip install -r requirements.txt
+          # pytest lives in requirements-dev.txt, not requirements.txt. Without
+          # this the test step dies with "No module named pytest".
+          .venv/bin/pip install -r requirements-dev.txt
       - name: Run backend tests
         run: .venv/bin/python -m pytest
 
@@ -83,15 +94,31 @@ jobs:
     steps:
       - name: Check out
         uses: actions/checkout@v4
+      - name: Set up Python
+        # Pin the interpreter instead of inheriting the runner image's default.
+        # requirements.txt is hash-pinned and was compiled on 3.14; on an older
+        # Python, alembic additionally requires tomli, which has no hash in the
+        # lock file and pip then refuses the whole install.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
       - name: Install dependencies
         run: |
           python3 -m venv .venv
           .venv/bin/pip install --upgrade pip
           .venv/bin/pip install -r requirements.txt
       - name: Force utf8mb4 on the CI database
+        # Uses pymysql, already a runtime dependency, rather than the mysql CLI,
+        # which is not present in every runner image.
         run: |
-          mysql -h 127.0.0.1 -uroot -proot -e \
-            "ALTER DATABASE shopdb_ci CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
+          .venv/bin/python - <<'PY'
+          import pymysql
+          c = pymysql.connect(host="127.0.0.1", port=3306, user="root", password="root")
+          with c.cursor() as cur:
+              cur.execute("ALTER DATABASE shopdb_ci CHARACTER SET utf8mb4 "
+                          "COLLATE utf8mb4_unicode_ci")
+          c.close()
+          PY
       - name: Fresh core upgrade from empty
         run: .venv/bin/flask db upgrade
       - name: Install every bundled plugin (runs its chain)