Make legacy-cgi a runtime dependency

erdr2pml (eReader/.pdb support) imports the stdlib `cgi` module at
runtime, which was removed in Python 3.13. Having legacy-cgi only in the
dev group meant eReader decryption would break on a 3.13+ runtime that
installed just the main dependencies. Move it to the main dependency
group, scoped with a `python >= 3.13` marker so it is installed only
where the stdlib module is gone (3.8-3.12 keep using the stdlib `cgi`).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

poetry.lock

@@ -121,7 +121,8 @@ version = "2.6.4"
 description = "Fork of the standard library cgi and cgitb modules removed in Python 3.13"
 optional = false
 python-versions = ">=3.8"
-groups = ["dev"]
+groups = ["main"]
+markers = "python_version >= \"3.13\""
 files = [
     {file = "legacy_cgi-2.6.4-py3-none-any.whl", hash = "sha256:7e235ce58bf1e25d1fc9b2d299015e4e2cd37305eccafec1e6bac3fc04b878cd"},
     {file = "legacy_cgi-2.6.4.tar.gz", hash = "sha256:abb9dfc7835772f7c9317977c63253fd22a7484b5c9bbcdca60a29dcce97c577"},
@@ -453,4 +454,4 @@ files = [
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.8,<4.0"
-content-hash = "a7172bce7871b58ba975c81418c1477022b8cd6ce275dcca76bcedcb766764e4"
+content-hash = "9fc37b99dff92b10826c26c2858070a6b2d62736dbc5c8076883c8d5dcc0b3c7"

pyproject.toml

@@ -30,6 +30,11 @@ pycryptodomex = ">=3.20"
 # epubfontdecrypt, epubwatermark, ignoblekey*).
 lxml = ">=5.0"
 
+# erdr2pml (eReader/.pdb support) imports the stdlib `cgi` module, which was
+# removed in Python 3.13. This backport restores it so eReader decryption keeps
+# working at runtime; only installed on 3.13+ where the stdlib module is gone.
+legacy-cgi = { version = ">=2.6", python = ">=3.13" }
+
 # SQLite access for Nook (Barnes & Noble) Windows Store key extraction is only
 # needed by DeDRM_plugin/ignoblekeyWindowsStore.py. Kept in an optional group so
 # the base environment installs cleanly on platforms where it is not required.
@@ -41,9 +46,6 @@ apsw = ">=3.46"
 
 [tool.poetry.group.dev.dependencies]
 pytest = ">=8.0"
-# Backport of the stdlib `cgi` module (removed in Python 3.13) so erdr2pml and
-# other modules that still import it can be loaded and tested.
-legacy-cgi = ">=2.6"
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]