Windows installer: payload hash-locking, SBOM, client-IP handling, operator docs

requirements.in

@@ -24,10 +24,14 @@ requests>=2.31
 # Security
 werkzeug>=3.0
 
+# Windows/IIS runtime
+# waitress is the WSGI server IIS launches via HttpPlatformHandler.
+# tzdata ships the IANA timezone database, which Windows does not provide;
+# without it the notifications plugin fails on zoneinfo lookups.
+# Both were previously hand-added to requirements.txt only, so a recompile
+# would have silently dropped them from every Windows install.
+waitress>=3.0
+tzdata
+
 # Validation
 email-validator>=2.0
-
-# Testing
-pytest>=7.0
-pytest-flask>=1.2
-pytest-cov>=4.0