cryptography is a declared dependency

docs/rewrite-status.md

@@ -46,7 +46,7 @@ done only when that spec is green.
 | E2E specs ported | **47 spec files** (v1 shipped 40; the specs still to port are listed under MUST) — green is the only measure that counts |
 | Backend operations still to port | **58** (see below; 32 more exist but nothing calls them) |
 | API operations v2 exposes | 237 (`frontend/schema.v2.yml`, kept fresh by its own gate) |
-| Unit tests | 2764 (all passing) |
+| Unit tests | 2773 (all passing) |
 | Coverage | above the 88.4 fail_under floor (coverage's own gate on CI's pytest --cov run; ratchets up per slice — never down) |
 | Type/lint debt | zero mypy baseline, every suppression counted in [`code-quality.md`](code-quality.md), all gates on every commit |
 | Behaviour ledger | 121 recorded deviations |

pyproject.toml

@@ -44,6 +44,11 @@ dependencies = [
  # rejects the result at employee-creation time.
  "python-stdnum>=2.1",
  "tinytag>=2.3.0",
+ # Main, not dev: scripts/ops/extract_v1_credentials.py decrypts v1's
+ # Fernet columns on the production host during cutover phase 0, in the
+ # `uv sync --frozen --no-dev` venv. Was only transitive before, which
+ # deptry rightly refuses (DEP003).
+ "cryptography>=46.0",
 ]
 
 [dependency-groups]