Refactor cron to call API via HTTP, capture base_url from browser

- meal-cron now runs send_reminders_cron.sh (simple wget loop, no DB mount)
- New /api/cron-tick endpoint handles all timezone logic server-side
- base_url captured from request.host_url when user saves ntfy settings,
  stored per-user — no APP_BASE_URL env var needed
- Cron endpoint protected by CRON_SECRET shared env var
- Removed send_reminders_cron.py, DB volume from cron container
- tests: 3 new cron-tick + base_url capture tests (69 total)

docker-compose.yml

@@ -9,6 +9,7 @@ services:
       - meal-data:/data
     environment:
       - SECRET_KEY=${SECRET_KEY:-change-me-in-production}
+      - CRON_SECRET=${CRON_SECRET:-change-me}
     restart: unless-stopped
     hostname: meal-tracker
     networks:
@@ -18,12 +19,9 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-    command: ["sh", "-c", "while true; do python3 /app/send_reminders_cron.py; sleep 60; done"]
-    volumes:
-      - meal-data:/data
+    command: ["sh", "/app/send_reminders_cron.sh"]
     environment:
-      - SECRET_KEY=${SECRET_KEY:-change-me-in-production}
-      - APP_BASE_URL=${APP_BASE_URL:-http://meal-tracker:5000}
+      - CRON_SECRET=${CRON_SECRET:-change-me}
     restart: unless-stopped
     networks:
       - caddy