[onethree7]

Stock preparation is now available from Calculator and Solver results. A/B/C quantities and batch doses use the existing calculation core and fertilizer catalogue. The stock container size and concentration stay fixed when the nutrient batch volume changes; only the batch dose scales.

The planner supports manual assignments and optional composition-based suggestions, saved recipe settings, and copy/print preparation sheets. Checks compare separate products without treating a manufacturer's own blend as a conflict. Exports require complete assignments, enough stock, and explicit review after product changes. Stocks use RO/distilled water. The old material catalogue and water-difference table are removed; both requested background articles open in the external browser.

This combines the stock feature and dependency updates into one change for a single squash merge:

• Bump idna from 3.18 to 3.19 #387: idna 3.19
• Bump ruff from 0.16.4 to 0.16.5 #388: Ruff 0.16.5
• Bump fast-uri from 3.1.5 to 3.1.7 in the npm_and_yarn group across 1 directory #390: fast-uri security update, extended to 3.1.8 for the newer advisory
• Bump the packaging-stack group across 1 directory with 2 updates #393: PyInstaller 6.22.3 and hooks 2026.8
• Bump the pydantic-stack group across 1 directory with 2 updates #395: Pydantic 2.14.0 and core 2.50.0
• Bump the github-actions-minor-and-patch group across 1 directory with 3 updates #396: pinned release-action updates, including the matching metadata assertion

Also updates the vulnerable js-yaml, brace-expansion, colord, postcss-selector-parser and source-map-js lock entries within their existing dependency ranges. No new dependencies. Version and notes are prepared for 0.6.7; this PR does not publish a release.

PyGObject #389 is excluded: pywebview 6.2.1 requires PyGObject 3.50.0 for GTK, so the proposed 3.58.0 constraint cannot resolve. The unchanged braces 3.0.3 advisory has no patched upstream version. Its dependency chain belongs to the Stylelint development tools and is not packaged with the application; npm audit still reports that chain. No downgrade or custom fork is introduced to hide it.

The request-body limiter now forwards receive calls to the transport after replay instead of fabricating a disconnect. This fixes static frontend delivery with Starlette 1.8.0; a regression test fails against the old behavior. Stock clipboard checks wait for completion, and exported article links are checked as exact source lines rather than unanchored URL regular expressions.

Validation:

• Fresh Windows environment installed with constraints-release.txt; pip check passed.
• python scripts/test.py -q: 422 passed, including the browser workflow; 19 Node tests passed. Ruff format/lint, ESLint and Stylelint passed.
• Focused stock, metadata and documentation checks: 52 passed.
• Release version check for v0.6.7 passed.
• npm audit --omit=dev: no findings. Full audit retains only the unpatched braces dependency chain.
• Full local suite also passed with FastAPI 0.143.1, Starlette 1.8.0 and AnyIO 4.15.1. The constrained release environment is checked separately.
• Final commit 6424921: Python 3.10/3.13 CI, dependency review and all three CodeQL analyses passed. Both reported URL-check findings are fixed.
• Windows and Linux package builds, Windows installer checks, and native GUI checks on Ubuntu 22.04/24.04, Debian 13 and Fedora 44 passed: https://github.com/onethree7/Horticalc/actions/runs/38766593366
• Downloaded Windows portable ZIP checksum verified. Packaged stock assets and planning were checked directly, including batch scaling and blocked incomplete/insufficient stock exports.

Closes #374.