# PR Summary

## Title

`Synology CI dependency hardening for snapshot_admin and KIS validation`

## Short Body

- `src/quant_engine/snapshot_admin_store_v1.py` no longer imports `zoneinfo`, so the Synology Python 3.8.12 runner can import the snapshot admin store without crashing.
- `src/quant_engine/kis_api_client_v1.py` now lazy-loads `requests`, which keeps the module importable in tests and turns missing dependency failures into explicit runtime validation errors.
- `.gitea/workflows/ci.yml`, `.gitea/workflows/kis_data_collection.yml`, and `.gitea/workflows/qualitative_sell_strategy.yml` now reinstall their Python dependencies on every run so cached venvs cannot hide missing packages.
- `.gitea/workflows/snapshot_admin.yml` now has a Python setup step that installs `pyyaml` before the snapshot admin workflow validators run.
- `docs/SYNOLOGY_SNAPSHOT_ADMIN_FINAL_EXECUTION_ONE_PAGER.md` remains the compact NAS field run sheet for the `WBS-7.9` live verification sequence.
- `docs/SYNOLOGY_SNAPSHOT_ADMIN_DEPLOYMENT_CHECKLIST.md` points at the one-page run sheet and keeps the evidence rule explicit so `WBS-7.9` stays open until NAS-side verification is archived.
- `docs/ROADMAP_WBS.md` still states the `WBS-4.1 -> WBS-4.2 -> WBS-4.3` wait order explicitly and separates loopback smoke success from actual NAS live verification.

## Verified

- `python tools/validate_snapshot_admin_web_v1.py`
- `python -m pytest tests/unit/test_snapshot_admin_web_v1.py -q`
- `python tools/validate_snapshot_admin_workflow_v1.py`
- `python tools/validate_platform_transition_wbs_v1.py`
- Local HTTP smoke against `snapshot_admin_server_v1.py`:
  - unauthenticated `GET /api/state` returned `401`
  - authenticated `GET /api/state` returned `200`
  - authenticated `GET /tables` returned `200`