Scaffold weather app: reception forecast display + shared internal API

- Backend: Fastify service polling Met Office DataHub (Global Spot: hourly,
  three-hourly, daily endpoints) with Open-Meteo fallback, hourly refresh.
  Reuses settings' hotel_location/met_office integrations (same pattern as
  hvac's lib/weather.js) rather than its own credential copy.
- Three display tiers stored in one forecast_points table: today (hourly),
  next 2 days (3-hourly), days 4-7 (plain daily) - 7 days total.
- Public /api/public/forecast (no auth) feeds the reception kiosk display;
  /api/internal/forecast (WEATHER_SECRET bearer) lets other apps read the
  stored forecast instead of polling providers themselves; /api/admin/*
  (normal JWT + settings cap) is the staff status/refresh page.
- Frontend: root / is the public full-screen Display (no AuthGate at all -
  first genuinely public app in the stack); /admin is the authed status
  page. apps.base_path is /weather/admin so the portal card opens the
  admin view directly, precedented by forecasting's history sub-route.
- LXC 131 / 10.10.10.131, registered in auth/src/db.js, push-to-forgejo.sh,
  and stack-init/install-stack.sh (deploy_weather + --only dispatch + full
  install chain).
- Typechecks and builds clean; not yet deployed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

seed-app.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// Run from weather/ dir: DATABASE_URL=... node seed-app.js
+import pg from 'pg'
+
+const { Pool } = pg
+const pool = new Pool({ connectionString: process.env.DATABASE_URL })
+
+// base_path is '/weather/admin', not '/weather' — the portal card should take staff
+// straight to the authed status/refresh page, not the public reception display at
+// the app's bare root. Precedented by forecasting's 'history' sub-route (see
+// project_weather memory / auth/src/db.js). internal_host/port ARE set (unlike
+// that precedent) since weather is its own real deployment, LXC 131.
+await pool.query(`
+  INSERT INTO apps (slug, name, description, base_path, icon, theme_color, category, internal_host, internal_port)
+  VALUES ('weather', 'Weather', 'Reception forecast display — today hourly, next 2 days, 7-day outlook', '/weather/admin', 'CloudSun', '#0ea5e9', 'Hotel', '10.10.10.131', 3080)
+  ON CONFLICT (slug) DO UPDATE SET
+    name          = EXCLUDED.name,
+    description   = EXCLUDED.description,
+    base_path     = EXCLUDED.base_path,
+    icon          = EXCLUDED.icon,
+    theme_color   = EXCLUDED.theme_color,
+    category      = EXCLUDED.category,
+    internal_host = EXCLUDED.internal_host,
+    internal_port = EXCLUDED.internal_port
+`)
+
+// Single capability — the public display itself needs no capability at all (see
+// routes/forecast.js's publicForecastRoutes). 'settings' gates the status/refresh
+// admin page, same slug every app uses for "configure this app's own settings".
+// Deliberately NOT auto-granted to Staff below (unlike tasks' 'use') — leave it for
+// an admin to grant explicitly via the portal (Admin → Roles), since it's an
+// admin-facing status page, not a general-use feature.
+await pool.query(`
+  INSERT INTO app_capabilities (app_id, slug, name, description, sort_order)
+  SELECT a.id, c.slug, c.name, c.description, c.sort_order
+  FROM apps a, (VALUES
+    ('settings', 'Settings', 'View forecast fetch status and trigger a manual refresh', 1)
+  ) AS c(slug, name, description, sort_order)
+  WHERE a.slug = 'weather'
+  ON CONFLICT (app_id, slug) DO NOTHING
+`)
+
+console.log('weather app seeded.')
+await pool.end()