Let the HA iPad dashboard read /api/status

The wall dashboard's Ombi tab now shows a lunch panel with pull time and
next scheduled run. It's served from Home Assistant (:8123), a different
origin, so allow that one origin to read the one read-only endpoint.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -123,6 +123,14 @@ pre-2026-09-08 app.
   a weekend, so that's a misread date (seen once: Fri 9/25's menu landed on
   Sat 9/26). Whatever month is live at the permalink is what gets read —
   there's no logic forcing "next month specifically."
+- **iPad dashboard reads `/api/status` (2026-09-29).** The HA iPad wall
+  dashboard's Ombi tab shows a lunch panel: today's menu (read from the HA
+  calendar, not this app) plus pull time / next scheduled from
+  `/api/status`. That page is served from HA (`http://192.168.86.207:8123`),
+  a different origin, so `_cors_for_dashboard` adds
+  `Access-Control-Allow-Origin` for that one origin on that one read-only
+  endpoint. Changing `/api/status`'s shape (`next_calendar_run`) breaks
+  that panel; moving HA's address means updating `DASHBOARD_ORIGIN`.
 - **Manual actions:** "Push This Month to Calendar" (`POST /api/push-calendar`
   → `push_month_to_calendar()`, same function the schedule calls — so it
   also pushes only today onward and skips weekend misreads) and