Remove thermostat/indoor sensor integration

Ecobee API is closed to new developer registrations and iOS sub-daily
automations are no longer available, making the HomeKit push approach
unworkable. Removes all related code:

- server.js: HomeKit push endpoints, token management, data files
- dashboard.html: thermostat section card, indoor stat tiles, indoor
  charts, HomeKit settings panel, HVAC badge CSS, all related JS
- index.html: Indoor Temp stat card
- app.js: indoor sensor display logic

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/server.js

@@ -600,79 +600,6 @@ app.get('/api/ambient', async (req, res) => {
   }
 });
 
-// ── HomeKit thermostat push ───────────────────────────────────────────────────
-const HOMEKIT_CONFIG_FILE = path.join(DATA_DIR, 'homekit-config.json');
-const HOMEKIT_LATEST_FILE = path.join(DATA_DIR, 'homekit-latest.json');
-
-let homekitConfig = { token: '' };
-let homekitLatest = null;
-
-try {
-  if (fs.existsSync(HOMEKIT_CONFIG_FILE)) {
-    homekitConfig = JSON.parse(fs.readFileSync(HOMEKIT_CONFIG_FILE, 'utf8'));
-  }
-} catch {}
-
-if (!homekitConfig.token) {
-  homekitConfig.token = crypto.randomBytes(32).toString('hex');
-  try { fs.writeFileSync(HOMEKIT_CONFIG_FILE, JSON.stringify(homekitConfig)); } catch {}
-}
-
-try {
-  if (fs.existsSync(HOMEKIT_LATEST_FILE)) {
-    homekitLatest = JSON.parse(fs.readFileSync(HOMEKIT_LATEST_FILE, 'utf8'));
-  }
-} catch {}
-
-// Get push token — dashboard auth
-app.get('/api/homekit/config', requireDashboardAuth, (_req, res) => {
-  res.json({ token: homekitConfig.token });
-});
-
-// Regenerate push token — dashboard auth
-app.post('/api/homekit/config/regenerate', requireDashboardAuth, (_req, res) => {
-  homekitConfig.token = crypto.randomBytes(32).toString('hex');
-  try { fs.writeFileSync(HOMEKIT_CONFIG_FILE, JSON.stringify(homekitConfig)); } catch {}
-  res.json({ token: homekitConfig.token });
-});
-
-// Receive thermostat data from iOS Shortcut — token in query string or header
-// Accepts both GET (query params) and POST (JSON body or query params)
-function handleHomekitPush(req, res) {
-  const token = req.query.token || req.headers['x-homekit-token'] || (req.body || {}).token;
-  if (!token || token !== homekitConfig.token) {
-    return res.status(401).json({ error: 'Unauthorized' });
-  }
-  const p = { ...(req.body || {}), ...req.query };
-
-  function parseTemp(val) {
-    const n = parseFloat(val);
-    if (isNaN(n)) return null;
-    return n < 50 ? +(n * 9 / 5 + 32).toFixed(1) : +n.toFixed(1);
-  }
-
-  homekitLatest = {
-    tempF: parseTemp(p.temperature ?? p.tempF),
-    heatSetF: parseTemp(p.heatSetF),
-    coolSetF: parseTemp(p.coolSetF),
-    humidity: p.humidity != null ? +parseFloat(p.humidity).toFixed(0) : null,
-    mode: p.mode || null,
-    hvacState: p.hvacState || null,
-    receivedAt: Date.now(),
-  };
-  try { fs.writeFileSync(HOMEKIT_LATEST_FILE, JSON.stringify(homekitLatest)); } catch {}
-  res.json({ ok: true });
-}
-
-app.get('/api/homekit/push', handleHomekitPush);
-app.post('/api/homekit/push', handleHomekitPush);
-
-// Latest thermostat reading — dashboard auth
-app.get('/api/homekit/data', requireDashboardAuth, (_req, res) => {
-  if (!homekitLatest) return res.status(503).json({ error: 'No data yet' });
-  res.json(homekitLatest);
-});
-
 // ── Personal weather station proxy ────────────────────────────────────────────
 app.get('/api/pws', async (req, res) => {
   const { url } = req.query;