feat(tests): add live subprocess integration test suite for services

Spins up each service's server.py in a real subprocess via a free ephemeral
port (PORT env var), connects with real protocol clients, and asserts both
correct protocol behavior and RFC 5424 log output.

- 44 live tests across 10 services: http, ftp, smtp, redis, mqtt,
  mysql, postgres, mongodb, pop3, imap
- Shared conftest.py: _ServiceProcess (bg reader thread + queue),
  free_port, live_service fixture, assert_rfc5424 helper
- PORT env var added to all 10 targeted server.py templates
- New pytest marker `live`; excluded from default addopts run
- requirements-live-tests.txt: flask, twisted + protocol clients

templates/http/server.py

@@ -10,11 +10,13 @@ import os
 from pathlib import Path
 
 from flask import Flask, request, send_from_directory
+from werkzeug.serving import make_server, WSGIRequestHandler
 from decnet_logging import syslog_line, write_syslog_file, forward_syslog
 
 NODE_NAME     = os.environ.get("NODE_NAME", "webserver")
 SERVICE_NAME   = "http"
 LOG_TARGET    = os.environ.get("LOG_TARGET", "")
+PORT          = int(os.environ.get("PORT", "80"))
 SERVER_HEADER = os.environ.get("SERVER_HEADER", "Apache/2.4.54 (Debian)")
 RESPONSE_CODE = int(os.environ.get("RESPONSE_CODE", "403"))
 FAKE_APP      = os.environ.get("FAKE_APP", "")
@@ -111,6 +113,13 @@ def catch_all(path):
     return body, RESPONSE_CODE, headers
 
 
+class _SilentHandler(WSGIRequestHandler):
+    """Suppress Werkzeug's Server header so Flask's after_request is the sole source."""
+    def version_string(self) -> str:
+        return ""
+
+
 if __name__ == "__main__":
     _log("startup", msg=f"HTTP server starting as {NODE_NAME}")
-    app.run(host="0.0.0.0", port=80, debug=False)  # nosec B104
+    srv = make_server("0.0.0.0", PORT, app, request_handler=_SilentHandler)  # nosec B104
+    srv.serve_forever()