Windows/IIS install fixes found by validating on a real win11 VM

Deployed to win11 + IIS + MySQL 5.6 end to end; fixed what broke.

- requirements.txt: add tzdata. Windows has no IANA tz database, so
  ZoneInfo('America/New_York') (notifications recognition/recert) fails and the
  plugin won't import. Also confirmed waitress (added earlier) is required.
- deploy/windows/web.config: comment out the X-Forwarded-For <rewrite> block by
  default - it needs URL Rewrite, and with it active but the module absent IIS
  returns HTTP 500.19. Uncomment after installing URL Rewrite.
- docs/DEPLOY-WINDOWS-IIS.md: add the required `appcmd unlock config` step for
  system.webServer/handlers + httpPlatform (locked server-wide by default ->
  500.19 without it) and the app-pool icacls grant.

Verified: IIS -> HttpPlatformHandler -> waitress -> app on :8090, all plugins
load, admin login works.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy/windows/web.config

@@ -44,10 +44,14 @@
     <!--
       OPTIONAL: forward the real client IP so audit logs and the kiosk
       visitor-location feature (IP -> business unit) see the caller, not the
-      loopback that HttpPlatformHandler connects from. Needs URL Rewrite.
-      Delete this whole <rewrite> block if URL Rewrite is not installed;
-      audit logs will then record 127.0.0.1 for a test instance.
-    -->
+      loopback that HttpPlatformHandler connects from.
+
+      This block is COMMENTED OUT by default because it needs the URL Rewrite
+      module; with it uncommented but URL Rewrite not installed, IIS returns
+      HTTP 500.19 ("configuration section not well-formed / cannot be read").
+      Install URL Rewrite (https://www.iis.net/downloads/microsoft/url-rewrite)
+      and then uncomment the <rewrite> block below to enable it.
+
     <rewrite>
       <allowedServerVariables>
         <add name="HTTP_X_FORWARDED_FOR" />
@@ -62,6 +66,7 @@
         </rule>
       </rules>
     </rewrite>
+    -->
 
   </system.webServer>
 </configuration>