fix(tests): green pytest gate for v0.8.1

Four root causes blocked the CI test gate; all fixed minimally:

1. test_release_provider._allow_private_urls used setenv +
   importlib.reload(ssrf_mod). The reload permanently rebound
   _ALLOW_PRIVATE=True in the module; monkeypatch.setenv undid the
   env var on teardown but the module attribute stayed True for the
   rest of the session, masking every test_ssrf*/test_ssrf_hardening
   case (16 failures). Switched to monkeypatch.setattr on the module
   attribute directly — restored cleanly on teardown.

2. _FakeResponse in test_release_provider lacked the content_length
   attribute and a top-level read() method that the new size-cap
   guards in gitea.py consult before parsing (5 failures).

3. test_gate_quiet_hours_wins_over_event_type_flag was asserting the
   pre-refactor gate order. evaluate_event_gate now intentionally
   reports EVENT_TYPE_DISABLED before QUIET_HOURS so deferrable
   events with the event-type flag off get dropped immediately
   instead of being deferred and then silently discarded at drain
   time. Renamed the test and inverted the expectation.

4. resolve_version() returned 0.0.0+unknown in CI because
   pip-wheel-built hatchling distributions ended up with METADATA
   missing the Version field — importlib.metadata returned None.
   Added __version__ = "0.8.1" to notify_bridge_server/__init__.py
   as a third (always-available) candidate; resolve_version() now
   picks the max of (installed, package, source).

packages/server/tests/test_deferred_dispatch.py

@@ -168,7 +168,7 @@ class _FakeTrackingConfig:
             setattr(self, attr, True)
 
 
-def test_gate_quiet_hours_wins_over_event_type_flag(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_gate_event_type_disabled_wins_over_quiet_hours(monkeypatch: pytest.MonkeyPatch) -> None:
     from notify_bridge_server.services import dispatch_helpers as dh
 
     class _FixedDatetime(datetime):
@@ -181,15 +181,15 @@ def test_gate_quiet_hours_wins_over_event_type_flag(monkeypatch: pytest.MonkeyPa
         quiet_hours_enabled=True,
         quiet_hours_start="12:00",
         quiet_hours_end="14:00",
-        # Even with the event-type flag flipped off, quiet hours should be
-        # the reported reason — it's the "louder" gate. The downstream defer
-        # path treats this as a deferral candidate; flipping the order would
-        # silently drop deferrable events when both gates are closed.
+        # When BOTH gates close, event_type_disabled wins — otherwise the
+        # event would defer through quiet hours and be silently dropped at
+        # drain time. The user already said "don't tell me about this kind
+        # of event", so honour that immediately rather than deferring.
         track_assets_added=False,
     )
     outcome = dh.evaluate_event_gate(_make_event(), tc, "UTC")
-    assert outcome.reason is dh.GateReason.QUIET_HOURS
-    assert outcome.quiet_hours_end_at == datetime(2026, 5, 12, 14, 0, tzinfo=timezone.utc)
+    assert outcome.reason is dh.GateReason.EVENT_TYPE_DISABLED
+    assert outcome.quiet_hours_end_at is None
 
 
 def test_gate_event_type_disabled_when_quiet_hours_off() -> None: