Issue resolved:

It turned out that the Python script (using psycopg2) was connecting to 127.0.0.1:5432, which is IPv4.
However, the SSH tunnel was listening only on IPv6 — ::1:5432.

As a result:

• DBeaver worked because the JDBC driver tries both stacks (IPv4 and IPv6).

• psycopg2 didn’t, because I was explicitly connecting to 127.0.0.1, where the tunnel wasn't listening.

In the code, I made an adjustment:
I forced psycopg2 to use IPv6 by specifying local_bind_address, and it automatically selected a free port.