chore(deps-dev): remove unused pytest-playwright from requirements-dev.txt

`pytest-playwright` was declared in requirements-dev.txt but imported
by zero files under tests/ — our Python E2E tests use
`playwright.sync_api` directly via tests/e2e/conftest.py and
tests/e2e/page_objects.py, not the pytest fixture wrapper.

Removal unblocks Dependabot PR #12 cleanly: bumping the lower bound on
an unused dep would just add churn for the next contributor. If we add
fixture-style E2E later, we'll re-add pytest-playwright at the version
we actually integrate against.

Files:
- requirements-dev.txt: drop the line + leave a maintenance comment so
  the next contributor understands why it's gone.
- docs/SBOM.md: remove from the dev-deps enumeration + add a removal
  note pointing to this commit.

Verified no remaining references via:
  grep -rn 'pytest_playwright\|pytest-playwright' tests/ requirements*.txt docs/

Author: RelativisticJet

docs/SBOM.md

@@ -65,9 +65,14 @@ version-pinning audit (`CLAUDE.md` "Splunk Version Pinning Audit").
 Audited separately in `docs/PIP_AUDIT_LOG.md` (B4):
 
 - `pytest`, `pytest-cov`, `freezegun`, `hypothesis`,
-  `pytest-timeout`, `playwright`, `pytest-playwright`, `radon`
+  `pytest-timeout`, `playwright`, `radon`
 - `playwright-core` (Node) for the E2E test runner
 
+> `pytest-playwright` was removed from `requirements-dev.txt` on
+> 2026-05-23 — it was declared but never imported (E2E Python tests
+> use `playwright.sync_api` directly). See the commit referenced
+> from Dependabot PR #12 for rationale.
+
 None of these are present in the .spl. They run only on developer
 machines and CI runners.
 

requirements-dev.txt

@@ -10,7 +10,13 @@ freezegun==1.5.1
 hypothesis==6.90.0
 pytest-timeout==2.1.0
 playwright==1.40.0
-pytest-playwright>=0.4.0
+# pytest-playwright removed 2026-05-23 — was declared but never imported.
+# Our E2E Python tests use `playwright.sync_api` directly (see
+# tests/e2e/conftest.py + page_objects.py); the pytest-fixture wrapper
+# was never wired in. Removal unblocks Dependabot PR #12 cleanly:
+# bumping an unused dep just adds churn. If we add fixture-style E2E
+# later, re-add pytest-playwright at the version we actually integrate
+# against.
 # radon 6.1.1 was a typo / aspirational pin — never published to PyPI,
 # so `pip install -r requirements-dev.txt` failed for any new contributor.
 # 6.0.1 is the actual latest and is what `metrics_collector.py` was