chore(deps): drop transitives from requirements.txt, split prod from dev (#28)

Only Flask and pytest are directly imported anywhere in the source. The
other 13 pinned packages (blinker, click, colorama, exceptiongroup,
iniconfig, itsdangerous, Jinja2, MarkupSafe, packaging, pluggy, tomli,
typing_extensions, Werkzeug) are transitive deps that pip resolves
automatically.

- requirements.txt: keep Flask only.
- requirements-dev.txt: -r requirements.txt + pytest, for tests.
- ci.yml: split into a prod-install-smoke job (installs requirements.txt
  only and boots the app via test_client — catches future un-listed
  third-party imports before merge) and the existing pytest job (now
  installs requirements-dev.txt).
- README: new Development section pointing at requirements-dev.txt for
  running the test suite.

Closes #27

Author: timon0305

.github/workflows/ci.yml

@@ -11,7 +11,8 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  pytest:
+  prod-install-smoke:
+    name: Verify prod requirements.txt is sufficient
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -22,8 +23,37 @@ jobs:
           cache: pip
           cache-dependency-path: requirements.txt
 
-      - name: Install dependencies
+      - name: Install production dependencies only
         run: pip install -r requirements.txt
 
+      # Boots the app under test_client without pytest. Catches the case
+      # where someone adds a real third-party import (e.g. werkzeug.X)
+      # to the source without bumping requirements.txt — that would
+      # surface here as ImportError before merge.
+      - name: Import + boot app
+        run: |
+          python - <<'PY'
+          from app import create_app
+          app = create_app()
+          client = app.test_client()
+          assert client.get("/").status_code == 200
+          PY
+
+  pytest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: |
+            requirements.txt
+            requirements-dev.txt
+
+      - name: Install dev dependencies (Flask + pytest)
+        run: pip install -r requirements-dev.txt
+
       - name: Run tests
         run: pytest --tb=short -q

README.md

@@ -107,9 +107,20 @@ claude-code-chat-browser/
 └── tests/
 ```
 
+## Development
+
+To run the test suite, install the dev requirements (Flask + pytest):
+
+```bash
+pip install -r requirements-dev.txt
+pytest
+```
+
+`requirements.txt` carries only the runtime dep (Flask); `requirements-dev.txt` pulls it in via `-r` and adds pytest.
+
 ## Continuous integration
 
-Every push and pull request runs **`pytest`** on **Ubuntu** (Python 3.12) via [`.github/workflows/ci.yml`](.github/workflows/ci.yml).
+Every push and pull request runs **`pytest`** on **Ubuntu** (Python 3.12) via [`.github/workflows/ci.yml`](.github/workflows/ci.yml). A separate job verifies that `pip install -r requirements.txt` (production-only) is sufficient to import and boot the app.
 
 ## Exported Markdown Format
 

requirements-dev.txt

@@ -0,0 +1,2 @@
+-r requirements.txt
+pytest==9.0.2

requirements.txt

@@ -1,15 +1 @@
-blinker==1.9.0
-click==8.3.1
-colorama==0.4.6
-exceptiongroup==1.3.1
 Flask==3.1.3
-iniconfig==2.3.0
-itsdangerous==2.2.0
-Jinja2==3.1.6
-MarkupSafe==3.0.3
-packaging==26.0
-pluggy==1.6.0
-pytest==9.0.2
-tomli==2.4.0
-typing_extensions==4.15.0
-Werkzeug==3.1.6