Wire up container timezone via /etc/localtime bind mount

Container defaulted to UTC (no TZ configured), so calendar_run_time and
the scraper's date-of-week logic didn't match the user's local clock.
Uncomments the existing /etc/localtime mount and installs tzdata so the
host's zoneinfo symlink actually resolves instead of silently falling
back to UTC.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013RbBoYm23muVyMZ18Ldqa6

CLAUDE.md

@@ -126,6 +126,25 @@ volume-mounted `/data` inside the container) holds the calendar pull
 schedule — this is live user data, not deploy-managed. `.env` holds
 `HA_WEBHOOK_URL` and is server-only, gitignored, never committed.
 
+**Container timezone (fixed 2026-09-08):** the container previously had no
+timezone configured — `python:3.12-slim` defaults to UTC and the
+`/etc/localtime` bind mount in `docker-compose.yml` was commented out — so
+`calendar_run_time` (and the `datetime.now()` call in `scraper.py` that
+picks which week to fetch) were evaluated against UTC, not the user's
+local clock. This happened to be masked because Arizona (no DST) and
+Pacific Daylight Time are both UTC-7 right now, but would have silently
+drifted the actual fire time by an hour once PDT becomes PST in November.
+Fixed by uncommenting the `/etc/localtime:/etc/localtime:ro` bind mount
+and installing `tzdata` in the `Dockerfile` — without `tzdata`, the
+host's `/etc/localtime` (typically a symlink into `/usr/share/zoneinfo/…`)
+would dangle inside the container since that directory wouldn't exist,
+silently falling back to UTC again. Found while investigating why the
+first automatic Sunday calendar push after the 2026-09-03 pivot appeared
+not to run — that specific miss turned out to be unrelated (the school's
+Nutrislice menu was published empty for the whole week, so `_push_calendar`
+correctly skipped every day), but this latent TZ bug surfaced during the
+investigation and was worth fixing regardless.
+
 **Migration note (2026-08-25):** this container originally used a Docker
 **named volume** (`lunch-notifier_lunch-settings`) instead of a bind mount.
 That meant Unraid's Appdata Backup plugin — which only knows about