Standardize on Python 3.13 (matches prod 3.13.7)

Prod runs Python 3.13.7, not the originally planned 3.12. Align the
stack: CI both jobs 3.12->3.13, the IIS install runbook and the dev
setup guide to 3.13 (winget Python.Python.3.13). NOTE for whoever
maintains the offline kit: its wheels are still cp312 and must be
regenerated as cp313 before the next air-gapped deploy.

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: '3.13'
           cache: pip
       - run: pip install -r requirements.txt
       - run: python -m pytest -q
@@ -72,7 +72,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: '3.13'
           cache: pip
       - run: pip install -r requirements.txt
       - name: Prime the CI database (utf8mb4 + native auth for pymysql)

docs/DEVELOPMENT-SETUP.md

@@ -23,7 +23,7 @@ sane, then use manual for day-to-day work.
 
 | Need | Version | Check |
 | --- | --- | --- |
-| Python | 3.12 (64-bit) | `python --version` |
+| Python | 3.13 (64-bit) - matches prod + CI | `python --version` |
 | Node.js | 18+ | `node --version` |
 | MySQL | 8.0 (or Docker, below) | `mysql --version` |
 | Git | any recent | `git --version` |
@@ -33,7 +33,7 @@ reopen the terminal so PATH updates):
 
 ```powershell
 winget install Git.Git                    # includes Git Bash (naming hook needs it)
-winget install Python.Python.3.12
+winget install Python.Python.3.13
 winget install OpenJS.NodeJS.LTS          # LTS; may install v24, fine for this SPA
 winget install Microsoft.VisualStudioCode
 winget install Oracle.MySQL               # or Docker.DockerDesktop for the DB

docs/INSTALL-WINDOWS-IIS.md

@@ -13,7 +13,7 @@ lives). Run PowerShell as Administrator.
 
 | Need | Notes |
 | --- | --- |
-| **Python 3.12** (64-bit) | `python --version` |
+| **Python 3.13** (64-bit) | `python --version` |
 | **IIS** with **HttpPlatformHandler** | https://www.iis.net/downloads/microsoft/httpplatformhandler (direct MSI: `download.microsoft.com/download/8/1/3/813AC4E6-9203-4F7A-8DD5-F3D54D10C5CD/httpPlatformHandler_amd64.msi`) |
 | **MySQL 5.7+/8.0** (or 5.6 with the flags in step 1) | reachable from the app host |
 | URL Rewrite (optional) | only for the real-client-IP rule; skip it and the app still runs |