Installer prerequisites: REQ-D through REQ-G

REQ-D: restore waitress and tzdata to requirements.in. They existed ONLY in the
generated requirements.txt (hand-added in bf9e60e), so the next
`uv pip compile` would have silently removed the WSGI server and the IANA
timezone database from every Windows install.

REQ-E: split production and development requirements. requirements.txt was
installing pytest, pytest-cov, pytest-flask, coverage, iniconfig and pluggy onto
production servers. Verified on a real Windows Server box before this change.
CI, scripts/test-external-plugin.sh and the dev docs now use requirements-dev.txt.

REQ-F: standardise on Python 3.14. The repo declared four different versions
(Dockerfile 3.12, DEPLOY-WINDOWS-IIS 3.12, INSTALL-WINDOWS-IIS 3.13, CI 3.13,
plus README, web.config and PLUGIN-EXTERNAL-REPO). 3.14 is in active bugfix
support until ~Apr 2027 and supported to Oct 2030; 3.13 entered security-only in
Apr 2026. All four compiled dependencies publish win_amd64 wheels for 3.14
(cryptography via an abi3 wheel), verified by building an offline wheelhouse and
installing it on Windows Server 2025.

REQ-G: state MySQL 8.0 as the standard for new installs; 5.7+/5.6 remain
supported on an existing server.

Lockfiles regenerated with uv pip compile. Production deps 44 -> 38.

requirements.txt

@@ -8,14 +8,16 @@ cachelib==0.13.0
     # via flask-caching
 certifi==2026.4.22
     # via requests
+cffi==2.1.0
+    # via cryptography
 charset-normalizer==3.4.7
     # via requests
 click==8.3.3
     # via
     #   -r requirements.in
     #   flask
-coverage==7.13.5
-    # via pytest-cov
+cryptography==50.0.0
+    # via -r requirements.in
 dnspython==2.8.0
     # via email-validator
 email-validator==2.3.0
@@ -29,7 +31,6 @@ flask==3.1.3
     #   flask-marshmallow
     #   flask-migrate
     #   flask-sqlalchemy
-    #   pytest-flask
 flask-caching==2.4.0
     # via -r requirements.in
 flask-cors==6.0.2
@@ -50,8 +51,6 @@ idna==3.13
     # via
     #   email-validator
     #   requests
-iniconfig==2.3.0
-    # via pytest
 itsdangerous==2.2.0
     # via flask
 jinja2==3.1.6
@@ -72,27 +71,11 @@ marshmallow-sqlalchemy==1.5.0
     # via -r requirements.in
 mysql-connector-python==9.7.0
     # via -r requirements.in
-packaging==26.2
-    # via pytest
-pluggy==1.6.0
-    # via
-    #   pytest
-    #   pytest-cov
-pygments==2.20.0
-    # via pytest
+pycparser==3.0
+    # via cffi
 pyjwt==2.12.1
     # via flask-jwt-extended
 pymysql==1.1.3
-cryptography>=42.0
-    # via -r requirements.in
-pytest==9.0.3
-    # via
-    #   -r requirements.in
-    #   pytest-cov
-    #   pytest-flask
-pytest-cov==7.1.0
-    # via -r requirements.in
-pytest-flask==1.3.0
     # via -r requirements.in
 python-dotenv==1.2.2
     # via -r requirements.in
@@ -109,14 +92,15 @@ typing-extensions==4.15.0
     # via
     #   alembic
     #   sqlalchemy
+tzdata==2026.3
+    # via -r requirements.in
 urllib3==2.7.0
     # via requests
+waitress==3.0.2
+    # via -r requirements.in
 werkzeug==3.1.8
     # via
     #   -r requirements.in
     #   flask
     #   flask-cors
     #   flask-jwt-extended
-    #   pytest-flask
-waitress>=3.0
-tzdata