Say what each dependency is for, and stop crediting fastapi for rich

The list read as a set of independent choices with two comments on it, one
of which was wrong: rich is not here "underneath fastapi's CLI" any more, it
is what textual is built on and what `fluksio status` imports directly.

Each line now says what imports it. The four that look redundant —
python-multipart, email-validator, jinja2, httpx — are also inside
`fastapi[standard]`, so they install nothing extra; they stay because the
code imports them directly and that should not rest on somebody else's
extra keeping its contents. email-validator in particular cannot move to
the server extra: `EmailStr` is on the user model, read on every start,
whether or not mail is ever sent.

Comments only. The resolved lock is byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019Hra4ndWMCLU5F3KjUuVAc

backend/fluksio/sdk/cli.py

@@ -644,8 +644,8 @@ def cmd_run(args: argparse.Namespace, rest: list[str]) -> int:
 # Status
 #
 # The home screen's top half, in a terminal: how the engine is, what each flow
-# is doing, and what failed recently. Drawn with rich, which is already here
+# is doing, and what failed recently. Drawn with rich, which is what the serve
-# under fastapi's own CLI.
+# dashboard renders this same group into.
 # ---------------------------------------------------------------------------
 
 

backend/pyproject.toml

@@ -21,25 +21,45 @@ classifiers = [
     "Topic :: Scientific/Engineering",
     "Topic :: System :: Distributed Computing",
 ]
+# Named because this code imports them. Four of them — python-multipart,
+# email-validator, jinja2 and httpx — also arrive inside `fastapi[standard]`,
+# so those lines look redundant and install nothing extra; they are here so a
+# direct import does not rest on somebody else's extra keeping its contents.
 dependencies = [
     "fastapi[standard]<1.0.0,>=0.114.2",
-    "python-multipart<1.0.0,>=0.0.7",
-    "email-validator<3.0.0.0,>=2.1.0.post1",
     "pydantic>2.0",
-    "jinja2<4.0.0,>=3.1.4",
+    "pydantic-settings<3.0.0,>=2.2.1",
+    "sqlmodel<1.0.0,>=0.0.21",
     "alembic<2.0.0,>=1.12.1",
     "httpx<1.0.0,>=0.25.1",
-    "sqlmodel<1.0.0,>=0.0.21",
+    # `Form(...)` on the OAuth token endpoint, which fastapi refuses to build
-    "pydantic-settings<3.0.0,>=2.2.1",
+    # the route without.
+    "python-multipart<1.0.0,>=0.0.7",
+    # `EmailStr` on the user model, so it is read on every start — an address
+    # is what a user is identified by, whether or not mail is ever sent. The
+    # sending itself is the `server` extra.
+    "email-validator<3.0.0.0,>=2.1.0.post1",
+    # Only the mail templates use it, and only after `send_email` — but it
+    # comes with `fastapi[standard]` either way, so an extra would move a line
+    # rather than a package.
+    "jinja2<4.0.0,>=3.1.4",
+    # Sessions, the secrets file, and the keypair an agent's token is signed
+    # with.
     "pyjwt<3.0.0,>=2.8.0",
     "pwdlib[argon2,bcrypt]>=0.3.0",
-    "numpy>=2.2.6",
+    "cryptography>=44.0.0",
+    # The state store and the work queue, and what a panel's config is read
+    # through.
     "redis>=7.1.0",
     # Every message costs a round trip's worth of encode and decode — state,
     # the journal, the worker pipe. Engine-side only: `fluksio-worker` is
     # copied onto other people's machines and stays dependency-free.
     "orjson>=3.10",
-    "cryptography>=44.0.0",
+    # The `mlp` node, which is registered at boot. Kept out of the extras
+    # because a data-science environment has it already.
+    "numpy>=2.2.6",
+    # The `inject` node's cron. Imported where it is used, behind a message
+    # that cannot fire while this line is here.
     "croniter>=1.3.0",
     "mcp>=1.29,<2",
     "fluksio-worker>=0.1,<0.2",
@@ -47,11 +67,10 @@ dependencies = [
     # the user's own. Present in the image; a pip install would otherwise have
     # to find one on PATH, and quietly fall back to the engine's interpreter.
     "uv>=0.5",
-    # `fluksio status` draws with it. Already here underneath fastapi's CLI,
+    # `fluksio status` draws with it, and textual is built on it — named
-    # named because a command that depends on it should say so.
+    # anyway, because a command that imports it should say so.
     "rich>=13",
-    # `fluksio serve` opens a dashboard with it at a terminal. Pure python and
+    # `fluksio serve` opens a dashboard with it at a terminal.
-    # mostly rich underneath, which is already here.
     "textual>=1.0",
 ]