Let the HA iPad dashboard read /api/status

The wall dashboard's Ombi tab now shows a lunch panel with pull time and
next scheduled run. It's served from Home Assistant (:8123), a different
origin, so allow that one origin to read the one read-only endpoint.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -123,6 +123,14 @@ pre-2026-09-08 app.
   a weekend, so that's a misread date (seen once: Fri 9/25's menu landed on
   Sat 9/26). Whatever month is live at the permalink is what gets read —
   there's no logic forcing "next month specifically."
+- **iPad dashboard reads `/api/status` (2026-09-29).** The HA iPad wall
+  dashboard's Ombi tab shows a lunch panel: today's menu (read from the HA
+  calendar, not this app) plus pull time / next scheduled from
+  `/api/status`. That page is served from HA (`http://192.168.86.207:8123`),
+  a different origin, so `_cors_for_dashboard` adds
+  `Access-Control-Allow-Origin` for that one origin on that one read-only
+  endpoint. Changing `/api/status`'s shape (`next_calendar_run`) breaks
+  that panel; moving HA's address means updating `DASHBOARD_ORIGIN`.
 - **Manual actions:** "Push This Month to Calendar" (`POST /api/push-calendar`
   → `push_month_to_calendar()`, same function the schedule calls — so it
   also pushes only today onward and skips weekend misreads) and

app.py

@@ -223,6 +223,18 @@ def api_integrations():
     })
 
 
+# The Home Assistant iPad wall dashboard (served from HA at :8123, a different
+# origin) reads /api/status for its lunch summary panel. Allow that one
+# origin to read that one read-only endpoint; everything else stays same-origin.
+DASHBOARD_ORIGIN = "http://192.168.86.207:8123"
+
+@app.after_request
+def _cors_for_dashboard(resp):
+    if request.path == "/api/status":
+        resp.headers["Access-Control-Allow-Origin"] = DASHBOARD_ORIGIN
+    return resp
+
+
 @app.route("/api/status")
 def api_status():
     return jsonify({