fix(tests): green pytest gate for v0.8.1

Four root causes blocked the CI test gate; all fixed minimally:

1. test_release_provider._allow_private_urls used setenv +
   importlib.reload(ssrf_mod). The reload permanently rebound
   _ALLOW_PRIVATE=True in the module; monkeypatch.setenv undid the
   env var on teardown but the module attribute stayed True for the
   rest of the session, masking every test_ssrf*/test_ssrf_hardening
   case (16 failures). Switched to monkeypatch.setattr on the module
   attribute directly — restored cleanly on teardown.

2. _FakeResponse in test_release_provider lacked the content_length
   attribute and a top-level read() method that the new size-cap
   guards in gitea.py consult before parsing (5 failures).

3. test_gate_quiet_hours_wins_over_event_type_flag was asserting the
   pre-refactor gate order. evaluate_event_gate now intentionally
   reports EVENT_TYPE_DISABLED before QUIET_HOURS so deferrable
   events with the event-type flag off get dropped immediately
   instead of being deferred and then silently discarded at drain
   time. Renamed the test and inverted the expectation.

4. resolve_version() returned 0.0.0+unknown in CI because
   pip-wheel-built hatchling distributions ended up with METADATA
   missing the Version field — importlib.metadata returned None.
   Added __version__ = "0.8.1" to notify_bridge_server/__init__.py
   as a third (always-available) candidate; resolve_version() now
   picks the max of (installed, package, source).

packages/server/tests/test_release_provider.py

@@ -129,6 +129,14 @@ class _FakeResponse:
 
         self.content = _FakeContent(json.dumps(payload).encode("utf-8"))
         self._payload = payload
+        # Mimic aiohttp.ClientResponse — readers consult content_length to
+        # short-circuit oversized bodies before reading.
+        self.content_length: int | None = None
+
+    async def read(self) -> bytes:
+        import json
+
+        return json.dumps(self._payload).encode("utf-8")
 
     async def json(self) -> Any:
         return self._payload
@@ -156,14 +164,13 @@ def _allow_private_urls(monkeypatch: pytest.MonkeyPatch) -> None:
     """SSRF guard rejects example.com → publicly resolvable, so tests pass.
 
     But we explicitly enable the bypass to remove DNS-resolution flakiness
-    from CI runs.
+    from CI runs. Patch the module attribute directly — env-var-plus-reload
+    permanently mutates the module and leaks the bypass into unrelated SSRF
+    test files that run later in the session.
     """
-    monkeypatch.setenv("NOTIFY_BRIDGE_ALLOW_PRIVATE_URLS", "1")
-    # Reload the ssrf module to pick up the env var (it's read at import).
-    import importlib
-
     import notify_bridge_core.notifications.ssrf as ssrf_mod
-    importlib.reload(ssrf_mod)
+
+    monkeypatch.setattr(ssrf_mod, "_ALLOW_PRIVATE", True)
 
 
 async def test_gitea_fetch_latest_happy_path() -> None: