pymysql needs the cryptography package to speak MySQL 8's default caching_sha2_password, so 'flask db upgrade' against a stock MySQL 8 failed with 'cryptography package is required'. Make it a real dependency (dev, prod, CI all connect cleanly) and drop the CI native-auth workaround that stood in for it.