Installer prerequisites: REQ-D through REQ-G

REQ-D: restore waitress and tzdata to requirements.in. They existed ONLY in the
generated requirements.txt (hand-added in bf9e60e), so the next
`uv pip compile` would have silently removed the WSGI server and the IANA
timezone database from every Windows install.

REQ-E: split production and development requirements. requirements.txt was
installing pytest, pytest-cov, pytest-flask, coverage, iniconfig and pluggy onto
production servers. Verified on a real Windows Server box before this change.
CI, scripts/test-external-plugin.sh and the dev docs now use requirements-dev.txt.

REQ-F: standardise on Python 3.14. The repo declared four different versions
(Dockerfile 3.12, DEPLOY-WINDOWS-IIS 3.12, INSTALL-WINDOWS-IIS 3.13, CI 3.13,
plus README, web.config and PLUGIN-EXTERNAL-REPO). 3.14 is in active bugfix
support until ~Apr 2027 and supported to Oct 2030; 3.13 entered security-only in
Apr 2026. All four compiled dependencies publish win_amd64 wheels for 3.14
(cryptography via an abi3 wheel), verified by building an offline wheelhouse and
installing it on Windows Server 2025.

REQ-G: state MySQL 8.0 as the standard for new installs; 5.7+/5.6 remain
supported on an existing server.

Lockfiles regenerated with uv pip compile. Production deps 44 -> 38.

docs/DEPLOY-WINDOWS-IIS.md

@@ -13,7 +13,7 @@ physical path must be `APP_ROOT` (where `wsgi.py` lives).
 
 ## 0. Prerequisites on the box
 
-- Python 3.12 (same minor as dev). `py -3.12 --version` to confirm.
+- Python 3.14 (same minor as dev and CI). `py -3.14 --version` to confirm.
 - IIS with the **HttpPlatformHandler** module:
   https://www.iis.net/downloads/microsoft/httpplatformhandler
 - **URL Rewrite** module (only for the optional real-client-IP rule).
@@ -39,7 +39,7 @@ Ship `frontend/dist` with the code (Node is not needed on the prod box).
 
 ```powershell
 cd C:\shopdb-flask
-py -3.12 -m venv venv
+py -3.14 -m venv venv
 venv\Scripts\python -m pip install --upgrade pip
 venv\Scripts\pip install -r requirements.txt
 ```

docs/DEVELOPMENT-SETUP.md

@@ -147,7 +147,7 @@ python -m venv venv
 venv\Scripts\Activate.ps1             # bash/mac: source venv/bin/activate
 # If PowerShell blocks the activate script (execution policy), run once:
 #   Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
-pip install -r requirements.txt
+pip install -r requirements-dev.txt
 
 copy .env.example .env                 # bash/mac: cp .env.example .env
 # Edit .env - set SECRET_KEY, JWT_SECRET_KEY, and

docs/INSTALL-WINDOWS-IIS.md

@@ -13,9 +13,9 @@ lives). Run PowerShell as Administrator.
 
 | Need | Notes |
 | --- | --- |
-| **Python 3.13** (64-bit) | `python --version` |
+| **Python 3.14** (64-bit) | `python --version` |
 | **IIS** with **HttpPlatformHandler** | https://www.iis.net/downloads/microsoft/httpplatformhandler (direct MSI: `download.microsoft.com/download/8/1/3/813AC4E6-9203-4F7A-8DD5-F3D54D10C5CD/httpPlatformHandler_amd64.msi`) |
-| **MySQL 5.7+/8.0** (or 5.6 with the flags in step 1) | reachable from the app host |
+| **MySQL 8.0** (standard for new installs) | reachable from the app host. 5.7+ is supported on an existing server; 5.6 needs the flags in step 1. CI and the container image both target 8.0. |
 | URL Rewrite (optional) | only for the real-client-IP rule; skip it and the app still runs |
 
 The app itself pulls in `waitress` and `tzdata` from `requirements.txt` (step 4).

docs/PLUGIN-EXTERNAL-REPO.md

@@ -85,7 +85,7 @@ ln -s ../../wjsf-shipping plugins/shipping
 
 # 3. Set up the framework as usual.
 python3 -m venv venv
-venv/bin/pip install -r requirements.txt
+venv/bin/pip install -r requirements-dev.txt
 
 # 4. Install (enable) your plugin.
 venv/bin/flask plugin install shipping
@@ -239,7 +239,7 @@ else
   python3 -m venv "$WORKDIR/venv"
   PYTHON="$WORKDIR/venv/bin/python"
   "$PYTHON" -m pip install --upgrade pip >/dev/null
-  "$PYTHON" -m pip install -r "$FRAMEWORK/requirements.txt"
+  "$PYTHON" -m pip install -r "$FRAMEWORK/requirements-dev.txt"
 fi
 
 echo "==> Linking plugin '$PLUGIN_NAME' into framework plugins/"
@@ -330,7 +330,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: '3.14'
       - name: Fetch the harness from the framework
         run: |
           git clone --depth 1 --branch "$FRAMEWORK_REF" "$FRAMEWORK_URL" /tmp/framework