Installer prerequisites: REQ-D through REQ-G

REQ-D: restore waitress and tzdata to requirements.in. They existed ONLY in the
generated requirements.txt (hand-added in bf9e60e), so the next
`uv pip compile` would have silently removed the WSGI server and the IANA
timezone database from every Windows install.

REQ-E: split production and development requirements. requirements.txt was
installing pytest, pytest-cov, pytest-flask, coverage, iniconfig and pluggy onto
production servers. Verified on a real Windows Server box before this change.
CI, scripts/test-external-plugin.sh and the dev docs now use requirements-dev.txt.

REQ-F: standardise on Python 3.14. The repo declared four different versions
(Dockerfile 3.12, DEPLOY-WINDOWS-IIS 3.12, INSTALL-WINDOWS-IIS 3.13, CI 3.13,
plus README, web.config and PLUGIN-EXTERNAL-REPO). 3.14 is in active bugfix
support until ~Apr 2027 and supported to Oct 2030; 3.13 entered security-only in
Apr 2026. All four compiled dependencies publish win_amd64 wheels for 3.14
(cryptography via an abi3 wheel), verified by building an offline wheelhouse and
installing it on Windows Server 2025.

REQ-G: state MySQL 8.0 as the standard for new installs; 5.7+/5.6 remain
supported on an existing server.

Lockfiles regenerated with uv pip compile. Production deps 44 -> 38.

README.md

@@ -20,7 +20,7 @@ ShopDB tracks and manages:
 ## Tech Stack
 
 **Backend:**
-- Python 3.12 with Flask
+- Python 3.14 with Flask
 - SQLAlchemy ORM
 - MySQL 5.7+ database (5.6 works with extra utf8mb4 config; see docs/DEPLOY.md)
 - JWT authentication
@@ -98,7 +98,7 @@ To maintain consistency with the legacy ShopDB database and codebase, the follow
 
 ### Prerequisites
 
-- Python 3.12
+- Python 3.14
 - Node.js 18+
 - MySQL 5.7+ (5.6 works with extra utf8mb4 config; see docs/DEPLOY.md)