back: deterministic readiness gate + MLDv2 flood fix for flaky backend tests (fixes #450)

[iakov]

Summary

The backend emulation suite (back/tests/test_miminet_back.py) was flaky in CI: it relied on fixed sleeps (network_configuration_time: 3 s default, 7 s RSTP, 33 s STP) to wait for the network to be "ready" before capturing traffic, and the packet captures let IPv6 MLDv2 multicast-report traffic crowd out the real ARP/ICMP exchange. Random failures such as No such RSTP object were the result (see #450).

This PR replaces the sleeps with a deterministic readiness gate, fixes the capture filter, retries cold captures, and de-duplicates OVS startup across the image, CI and the local harness — fixing the same rogue-second-ovs-vswitchd bug in the prod image too.

Changes

1. Deterministic readiness gate — back/src/network.py, back/src/network_topology.py, back/src/tasks.py

• Wait until STP/RSTP state has settled on every switch, all VXLAN VTEP peers are reachable, and every capture file is non-empty (bounded by a timeout) instead of sleeping a fixed 3/7/33 s.
• Retry a cold capture once if the gate detects an unconverged network (first ARP packets can be dropped while OVS is still wiring bridges).
• tasks.py retries the emulation (bounded, up to 4 attempts) when a network that defines jobs produces an animation without any meaningful host traffic.
• Removed network_configuration_time and its per-STP-mode sleep selection from MiminetTopology.

2. Capture filter fix — back/src/network_topology.py

• not igmp and not ip6: the switches emit a steady IPv6 MLDv2 multicast-report flood that fills every capture buffer and drops the real ARP/ICMP exchange. Networks are IPv4-only (use_v6=False), so IPv6 is pure noise.

3. OVS single source of truth — back/ovs-init.sh (new), back/Dockerfile, back/ENTRYPOINT.sh, scripts/back-test.sh, .github/workflows/back_test.yml, DEVELOPMENT.md

• back/ovs-init.sh starts OVS exactly once (ovs-ctl start, with a fallback spawn of ovs-vswitchd only if it did not start).
• Fixes the same second-ovs-vswitchd bug in the prod image ENTRYPOINT.sh — a second instance fights over the bridges and produces random No such RSTP object failures.
• Baked into the image at /app/ovs-init.sh; the local harness (scripts/back-test.sh) and CI (back_test.yml) call the same file, so all three paths stay in sync.

4. Small refactors — back/src/net_utils/, back/src/emulator.py

• Extracted shared capture-path helpers and VLAN/VXLAN interface predicates that were inlined (slightly differently) across files.
• Added back/tests/test_captures.py with 3 unit tests for the capture path helpers.

Validation

• Full suite: 27 passed (24 emulation tests + 3 new unit tests), confirmed across repeated local runs and in CI.
• Lint (mypy / black / flake8 with the CI flags): clean.

Risks / notes for maintainers

• The readiness gate polls until STP/RSTP converges instead of the fixed 33 s STP sleep. On a very slow cold host the gate's timeout could fire on a network that would eventually have converged; the emulation task then retries once (bounded), and the timeout is a single constant if it ever needs tuning.
• The ENTRYPOINT.sh change routes prod containers through /app/ovs-init.sh. Behavior is identical when OVS starts cleanly (a single ovs-vswitchd); it only changes the failure mode from "two competing instances" to "one correct instance".
• Known gap: DEVELOPMENT.md still documents "Expected: 24 passed" for the backend suite; it now collects 27 tests (24 emulation + 3 new unit tests). That doc line was left unchanged to keep the diff minimal.

Fixes #450.