Add requirements.txt and correct the dependency list

Add a requirements file (pyscard, opencv-python, openpyxl) so users can
pip install -r requirements.txt. Remove the incorrect cryptography
dependency from the README - all crypto uses the Python standard library.

README.md

@@ -123,13 +123,13 @@ with `qr_to_sheet.py`.
 ## Requirements
 
 - Python 3.9+
-- `pyscard`, `cryptography`, `openpyxl` (for reading legacy `.xlsx`), and
+- `pyscard` (smartcard access), `opencv-python` (QR decoding), and `openpyxl`
-  `opencv-python` (for QR decoding).
+  (reading legacy `.xlsx`). All cryptography uses the Python standard library.
 - For writing to a card: a PC/SC reader with the Apex (over NFC) or a JavaCard
   carrying the applet presented to it.
 
 ```
-pip install pyscard cryptography openpyxl opencv-python
+pip install -r requirements.txt
 ```
 
 ---

requirements.txt

@@ -0,0 +1,9 @@
+# otp-import runtime dependencies (Python 3.9+)
+# Install with:  pip install -r requirements.txt
+#
+# All cryptography (PBKDF2, HMAC, Base32) uses the Python standard library,
+# so there is no separate crypto dependency.
+
+pyscard>=2.0         # PC/SC smartcard access (apex_otp_import.py)
+opencv-python>=4.5   # QR-code decoding (qr_to_sheet.py)
+openpyxl>=3.0        # reading legacy .xlsx input (apex_otp_import.py, tests)