Scaffold weather app: reception forecast display + shared internal API

- Backend: Fastify service polling Met Office DataHub (Global Spot: hourly,
  three-hourly, daily endpoints) with Open-Meteo fallback, hourly refresh.
  Reuses settings' hotel_location/met_office integrations (same pattern as
  hvac's lib/weather.js) rather than its own credential copy.
- Three display tiers stored in one forecast_points table: today (hourly),
  next 2 days (3-hourly), days 4-7 (plain daily) - 7 days total.
- Public /api/public/forecast (no auth) feeds the reception kiosk display;
  /api/internal/forecast (WEATHER_SECRET bearer) lets other apps read the
  stored forecast instead of polling providers themselves; /api/admin/*
  (normal JWT + settings cap) is the staff status/refresh page.
- Frontend: root / is the public full-screen Display (no AuthGate at all -
  first genuinely public app in the stack); /admin is the authed status
  page. apps.base_path is /weather/admin so the portal card opens the
  admin view directly, precedented by forecasting's history sub-route.
- LXC 131 / 10.10.10.131, registered in auth/src/db.js, push-to-forgejo.sh,
  and stack-init/install-stack.sh (deploy_weather + --only dispatch + full
  install chain).
- Typechecks and builds clean; not yet deployed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/App.tsx

@@ -0,0 +1,29 @@
+import { BrowserRouter, Routes, Route, Navigate } from 'react-router-dom'
+import AuthGate from './components/AuthGate'
+import { UpdateBanner } from './components/UpdateBanner'
+import IosInstallHint from './components/IosInstallHint'
+import { useVersionCheck } from './hooks/useVersionCheck'
+import Display from './pages/Display'
+import Admin from './pages/Admin'
+
+// Root ("/") is the public, unauthenticated reception display — that's this app's
+// primary purpose, not a staff tool (see project_weather memory). Only "/admin" is
+// gated behind the normal AuthGate + 'settings' capability, matching every other
+// app's login pattern. The portal's card links straight to /admin (apps.base_path =
+// '/weather/admin' in the auth DB) — see seed-app.js.
+export default function App() {
+  const updateAvailable = useVersionCheck('/weather/health')
+  return (
+    <>
+      <BrowserRouter basename="/weather">
+        <Routes>
+          <Route path="/admin" element={<AuthGate><Admin /></AuthGate>} />
+          <Route path="/" element={<Display />} />
+          <Route path="*" element={<Navigate to="/" replace />} />
+        </Routes>
+      </BrowserRouter>
+      <UpdateBanner visible={updateAvailable} />
+      <IosInstallHint />
+    </>
+  )
+}