Let the HA iPad dashboard read /api/status

The wall dashboard's Ombi tab now shows a lunch panel with pull time and
next scheduled run. It's served from Home Assistant (:8123), a different
origin, so allow that one origin to read the one read-only endpoint.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app.py

@@ -223,6 +223,18 @@ def api_integrations():
     })
 
 
+# The Home Assistant iPad wall dashboard (served from HA at :8123, a different
+# origin) reads /api/status for its lunch summary panel. Allow that one
+# origin to read that one read-only endpoint; everything else stays same-origin.
+DASHBOARD_ORIGIN = "http://192.168.86.207:8123"
+
+@app.after_request
+def _cors_for_dashboard(resp):
+    if request.path == "/api/status":
+        resp.headers["Access-Control-Allow-Origin"] = DASHBOARD_ORIGIN
+    return resp
+
+
 @app.route("/api/status")
 def api_status():
     return jsonify({