PR Summary

Title

Synology mock KIS validation dry-run and workflow dependency hardening

src/quant_engine/snapshot_admin_store_v1.py no longer imports zoneinfo, so the Synology Python 3.8.12 runner can import the snapshot admin store without crashing.
src/quant_engine/kis_api_client_v1.py now lazy-loads requests, which keeps the module importable in tests and turns missing dependency failures into explicit runtime validation errors.
.gitea/workflows/ci.yml, .gitea/workflows/kis_data_collection.yml, and .gitea/workflows/qualitative_sell_strategy.yml now reinstall their Python dependencies on every run so cached venvs cannot hide missing packages.
tools/validate_kis_api_credentials_v1.py now supports --dry-run, and the mock validation steps in the workflows use it so repo-variable checks no longer depend on live KIS API access.
docs/GITEA_VARIABLES_RUNBOOK.md and docs/GITEA_VARIABLES_SMOKE_CHECKLIST.md now say the mock credential check is dry-run only.
docs/SYNOLOGY_SNAPSHOT_ADMIN_FINAL_EXECUTION_ONE_PAGER.md remains the compact NAS field run sheet for the WBS-7.9 live verification sequence.
docs/SYNOLOGY_SNAPSHOT_ADMIN_DEPLOYMENT_CHECKLIST.md points at the one-page run sheet and keeps the evidence rule explicit so WBS-7.9 stays open until NAS-side verification is archived.
docs/ROADMAP_WBS.md still states the WBS-4.1 -> WBS-4.2 -> WBS-4.3 wait order explicitly and separates loopback smoke success from actual NAS live verification.

python tools/validate_snapshot_admin_web_v1.py
python -m pytest tests/unit/test_snapshot_admin_web_v1.py -q
python tools/validate_platform_transition_wbs_v1.py
python tools/validate_snapshot_admin_workflow_v1.py
Local HTTP smoke against snapshot_admin_server_v1.py:
- unauthenticated GET /api/state returned 401
- authenticated GET /api/state returned 200
- authenticated GET /tables returned 200