chore(deps): drop transitives from requirements.txt, split prod from dev

Only Flask and pytest are directly imported anywhere in the source. The
other 13 pinned packages (blinker, click, colorama, exceptiongroup,
iniconfig, itsdangerous, Jinja2, MarkupSafe, packaging, pluggy, tomli,
typing_extensions, Werkzeug) are transitive deps that pip resolves
automatically.

- requirements.txt: keep Flask only.
- requirements-dev.txt: -r requirements.txt + pytest, for tests.
- ci.yml: split into a prod-install-smoke job (installs requirements.txt
  only and boots the app via test_client — catches future un-listed
  third-party imports before merge) and the existing pytest job (now
  installs requirements-dev.txt).
- README: new Development section pointing at requirements-dev.txt for
  running the test suite.

Closes #27

Author: timon0305

.github/workflows/ci.yml

@@ -11,7 +11,8 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  pytest:
+  prod-install-smoke:
+    name: Verify prod requirements.txt is sufficient
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -22,8 +23,37 @@ jobs:
           cache: pip
           cache-dependency-path: requirements.txt
 
-      - name: Install dependencies
+      - name: Install production dependencies only
         run: pip install -r requirements.txt
 
+      # Boots the app under test_client without pytest. Catches the case
+      # where someone adds a real third-party import (e.g. werkzeug.X)
+      # to the source without bumping requirements.txt — that would
+      # surface here as ImportError before merge.
+      - name: Import + boot app
+        run: |
+          python - <<'PY'
+          from app import create_app
+          app = create_app()
+          client = app.test_client()
+          assert client.get("/").status_code == 200
+          PY
+
+  pytest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: |
+            requirements.txt
+            requirements-dev.txt
+
+      - name: Install dev dependencies (Flask + pytest)
+        run: pip install -r requirements-dev.txt
+
       - name: Run tests
         run: pytest --tb=short -q

README.md

@@ -107,9 +107,20 @@ claude-code-chat-browser/
 └── tests/
 ```
 
+## Development
+
+To run the test suite, install the dev requirements (Flask + pytest):
+
+```bash
+pip install -r requirements-dev.txt
+pytest
+```
+
+`requirements.txt` carries only the runtime dep (Flask); `requirements-dev.txt` pulls it in via `-r` and adds pytest.
+
 ## Continuous integration
 
-Every push and pull request runs **`pytest`** on **Ubuntu** (Python 3.12) via [`.github/workflows/ci.yml`](.github/workflows/ci.yml).
+Every push and pull request runs **`pytest`** on **Ubuntu** (Python 3.12) via [`.github/workflows/ci.yml`](.github/workflows/ci.yml). A separate job verifies that `pip install -r requirements.txt` (production-only) is sufficient to import and boot the app.
 
 ## Exported Markdown Format
 

requirements-dev.txt

@@ -0,0 +1,2 @@
+-r requirements.txt
+pytest==9.0.2

requirements.txt

@@ -1,15 +1 @@
-blinker==1.9.0
-click==8.3.1
-colorama==0.4.6
-exceptiongroup==1.3.1
 Flask==3.1.3
-iniconfig==2.3.0
-itsdangerous==2.2.0
-Jinja2==3.1.6
-MarkupSafe==3.0.3
-packaging==26.0
-pluggy==1.6.0
-pytest==9.0.2
-tomli==2.4.0
-typing_extensions==4.15.0
-Werkzeug==3.1.6