feat: run live tests against a local TrackMe Docker instance

[smeinecke]

Changes proposed in this pull request:

As introduced in #42 the live and blocking test suites hit tls.peet.ws (a public
fingerprint-inspection service) directly, making CI dependent on external
availability and preventing deterministic fingerprint assertions. This PR
introduces a self-hosted TrackMe
container that spins up inside CI, so all TLS/HTTP2 fingerprint tests run
against https://localhost:8443 with no external dependencies.

---

Docker setup

• Add docker/trackme/Dockerfile - builds TrackMe from source
  (golang:1.24-alpine, no pcap/QUIC, listens on 8443/8080)
• Add docker/trackme/config.json and static/ assets
• Add docker-compose.test.yml with network_mode: host (required: uTLS
  rejects connections arriving via Docker's veth bridge NAT, which causes
  bad record MAC errors; host networking bypasses the bridge entirely)
• Add scripts/setup-trackme-certs.sh - generates a self-signed cert and
  prints the SSL_CERT_FILE hint for local runs

CI workflows (blocking-tests.yml, live-tests.yml)

• Generate a self-signed TLS cert; combine with the system CA bundle so the
  Go TLS stack trusts it without insecure_skip_verify
• Start TrackMe via docker compose and wait for the container's own
  HEALTHCHECK (BusyBox wget) to report healthy - curl was avoided because
  OpenSSL triggers bad record MAC in the uTLS server for some cipher suites
• Inject TRACKME_URL=https://localhost:8443 and SSL_CERT_FILE for the
  test run
• Expand live-tests.yml to a Python 3.10 – 3.13 matrix (ubuntu-only,
  since TrackMe requires Docker), matching the unit-test matrix breadth

Test files (20+ files updated)

• All BASE_URL / hardcoded tls.peet.ws references replaced with
  os.environ.get("TRACKME_URL", "https://tls.peet.ws") for backward
  compatibility when running locally without TrackMe
• Test files that hit tls.peet.ws / scrapfly.io in the unit-test
  workflow now carry pytestmark = pytest.mark.live so they are excluded
  from unit tests (no external network) and included in live tests (TrackMe
  available)

Stale connection fixes

CycleTLS loads the Go HTTP transport as a process-global shared library.
TrackMe closes the TLS connection after every response; the global Go
transport caches the closed connection in roundTripper.cachedConnections,
and the next test reuses it - causing "use of closed network connection".
Root fix: inject enable_connection_reuse=False (which bypasses the pool
and creates a fresh roundTripper per request) via a _no_reuse wrapper
applied to every fixture that makes requests to TrackMe:

• conftest.py session-scoped cycletls_client (covers test_integration,
  test_http2_fingerprint, test_tls13)
• All local fixtures in test_force_http1, test_http2,
  test_ja3_fingerprints, test_ja4_fingerprints
• Individual async requests in test_async_ja3 (async tests create their
  own client per test; the wrapper pattern can't be applied)
• test_module_api: uses cycletls.set_default(enable_connection_reuse=False)
  in setup_method
• Additional edge cases: test_post_method skips gracefully when TrackMe
  rejects non-GET via HTTP/2 RST_STREAM; test_multiple_clients passes
  enable_connection_reuse=False explicitly since those clients are created
  directly in the test body and bypass the fixture

Before submitting

• I've read and followed all steps in the Making a pull request section of the CONTRIBUTING docs.
• I've updated or added any relevant docstrings following the syntax described in the Writing docstrings section of the CONTRIBUTING docs.
• If this PR fixes a bug, I've added a test that will fail without my fix.
• If this PR adds a new feature, I've added tests that sufficiently cover my new functionality.

After submitting

• All GitHub Actions jobs for my pull request have passed.