chore: separate runtime and test dependencies

[Pratham2511]

Summary

Runtime installs included an unused serialization package and pytest tooling. Remove dataclasses-json from both runtime requirement files and keep test dependencies in requirements-dev.txt.

Closes #533

Changes

• Move pytest, pytest-cov, and pytest-asyncio into requirements-dev.txt with their existing version constraints.
• Install runtime and dev requirements in CI, retain the separate flake8 install, and include dev requirements in the pip cache key.
• Document developer/test installation in CONTRIBUTING and correct the requirements consistency test's docstring.

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update

Dependency cleanup with no runtime behavior change.

Testing

• I have tested these changes locally
• I have added/updated tests as needed

Existing consistency assertions were retained; their descriptive docstring was updated. Validation:

• Python 3.10.22 and 3.11.17: 584 tests passed on each, including coverage; critical flake8 passed. The advisory lint lane retained its existing exit-zero behavior.
• Fresh runtime-only and web-only installs on Python 3.11.17 succeeded without dataclasses-json, pytest, pytest-cov, pytest-asyncio, or coverage. Fresh developer installs succeeded on both CI Python versions. All four environments passed pip check.
• The web-only source backend returned HTTP 200 from /healthz and generated a PDF with xhtml2pdf.
• Docker build/smoke checks were not run locally because Docker is unavailable. Remote CI is pending.

Screenshots

Not applicable to this dependency cleanup.

AI assistance

AI assistance was used to prepare the dependency, CI, and documentation changes and run the local checks above. Independent local review reproduced the installation, test, and lint results and found no implementation defects. Docker image verification remains incomplete pending CI.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Thanks for the first pull request here. CI needs a maintainer to approve the run before it starts, so it may sit for a bit before anything happens. pytest tests/ -q passing is the main thing I look at.