Separate production and development dependencies

[ichwars]

Summary

• keep Python runtime dependencies separate from test, lint, lock, and audit tooling
• layer requirements-dev.txt on requirements.txt and regenerate both Python 3.12 hash locks
• enforce the boundary in CI and pre-commit with regression tests

Runtime impact

• removes pytest, pytest-asyncio, ruff, iniconfig, and pluggy from the production lock
• keeps all development tooling in requirements-dev.lock.txt

Local verification

• 7532 backend tests passed, 245 skipped
• 244 frontend test files / 2848 tests passed; locale parity passed
• ESLint, TypeScript, and Vite production build passed
• Ruff check/format, source-size budget, Actionlint, and diff checks passed
• production and development hash-lock dry-runs passed on Python 3.12.13
• dependency-boundary tests: 8 passed; combined checker tests: 22 passed

Environment note

The local Docker daemon is not running, so the repository's required CI Docker build and integration suite remain the container-level verification gate.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bf6c5d2cc6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".