Default to America/Phoenix and email-alert once when the session expires

Phoenix doesn't observe DST, so schedule times stay meaningful
year-round without needing a seasonal adjustment.

notify.py reuses lunch-notifier's existing Gmail-SMTP-with-app-password
pattern rather than adding a new notification channel. The alert fires
exactly once per expiry (not on every failed scheduled run while it's
down) via a dedupe flag in notify_state.json, reset the moment a fresh
session is successfully imported.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6TgffxTvYhqxykAbVQg2v

.claude/skills/deploy-massprice/SKILL.md

@@ -38,7 +38,9 @@ cd /mnt/user/appdata/massprice && docker compose restart
 
 1. Create `/mnt/user/appdata/massprice` on Unraid and a real `.env`
    there (copy `.env.example`, fill in `LOGIN_PASSWORD`, `SECRET_KEY`,
-   `HOST_PORT`, `TZ`).
+   `HOST_PORT`, `TZ` — and optionally `GMAIL_USER`/`GMAIL_APP_PASSWORD`/
+   `ALERT_EMAIL` for the session-expiry email alert, same Gmail-app-
+   password pattern as `lunch-notifier`).
 2. First `docker compose up -d --build` — confirm the container starts
    and `/login` responds on `HOST_PORT`.
 3. Log into the webui, go to the **Session** page, and follow its
@@ -61,12 +63,14 @@ cd /mnt/user/appdata/massprice && docker compose restart
 
 ## Persistent state, never touched by deploys
 
-`.env` holds `LOGIN_PASSWORD` and `SECRET_KEY`. `data/` (bind-mounted to
+`.env` holds `LOGIN_PASSWORD`, `SECRET_KEY`, and (optionally)
+`GMAIL_USER`/`GMAIL_APP_PASSWORD`/`ALERT_EMAIL`. `data/` (bind-mounted to
 `/data`) holds `schedules.json` (the schedules set from the webui),
 `auth_state.json` (the saved MassPrice session imported via the Session
 page — a live bearer credential for the user's MassPrice account while
 valid, see `CLAUDE.md`; losing this just costs one re-import, not data),
-`run_history.json`, and `rules_cache.json`. Both are excluded from the
+`run_history.json`, `rules_cache.json`, and `notify_state.json` (the
+session-expiry alert's send-once dedupe flag). Both are excluded from the
 deploy rsync (which runs `--delete`) and from git.
 
 ## If scheduled runs stop working