Refactor cron to call API via HTTP, capture base_url from browser

- meal-cron now runs send_reminders_cron.sh (simple wget loop, no DB mount)
- New /api/cron-tick endpoint handles all timezone logic server-side
- base_url captured from request.host_url when user saves ntfy settings,
  stored per-user — no APP_BASE_URL env var needed
- Cron endpoint protected by CRON_SECRET shared env var
- Removed send_reminders_cron.py, DB volume from cron container
- tests: 3 new cron-tick + base_url capture tests (69 total)

AGENTS.md

@@ -24,7 +24,7 @@ Flask web app for tracking household meal attendance. Users register into househ
 | `Dockerfile` | Python 3.13-alpine. **Must list every `.py` file in the COPY line.** |
 | `docker-compose.yml` | Two services: `meal-tracker` (web) and `meal-cron` (sends reminders). Both on external `caddy` network, shared `meal-data` volume at `/data`. |
 | `watch-for-updates.sh` | Polls git remote, rebuilds on change. Uses `docker compose` with env vars from `.env`. |
-| `send_reminders_cron.py` | Standalone script run every 60s by the `meal-cron` container. Checks per-household local time against 10:00/16:00 triggers. |
+| `send_reminders_cron.sh` | Simple shell loop run by `meal-cron`: calls `POST /api/cron-tick` on `meal-tracker:5000` every 60s with `X-Cron-Secret` header. No DB access — all logic is server-side. |
 | `doc/index.md` | Full project documentation |
 | `README.md` | Symlink → `doc/index.md` |