Figure out proper story for pinned dependencies

Right now, we provide `requirements.txt`, `requirements.server.txt` and `requirements.client.txt`. We also have `.[dev]` and `.[server]` dependencies in the `pyproject.toml` file.

Do we need/want to pin down exact dependencies somewhere? Should we do that in a lockfile generated via `pip freeze`? Or should we instead get rid of `requirements.txt` and distribute a Docker image?

What's the canonical way for users to install a package along with a specific frozen list of its dependencies?

Start by reviewing requirements.txt, requirements.server.txt, requirements.client.txt, and the dependency declarations in pyproject.toml. Compare the proposed approaches—pip freeze lockfiles, removing requirements files, and distributing a Docker image—and define the canonical installation path before making a change.

Written by the indexing model from the issue text.