Serve the panel snapshot behind a reusable service-token dependency (task ae7e90ae)

The panel plane (D-012) needs an authenticated read surface the HA
integration polls: GET /api/v1/panel/snapshot. The token check lives in
ONE reusable dependency (api/dependencies.require_panel_token) — missing,
malformed, wrong, and empty-configured credentials all fail closed with
the same 401 (constant-time compare, uniform detail) — and the panel
router attaches it once so every later panel route inherits the check.

ApiConfig gains the required NESTQUEST_PANEL_TOKEN (same fail-fast
discipline as NESTQUEST_DB_PATH: unset/empty is a ConfigError, never a
silent default), create_app stores the resolved config on app.state so
the dependency reads it without module state, and the snapshot handler
stays a thin adapter: it calls the pure core build_snapshot with the
live database and one timezone-aware clock read, shapes each child's
instances through core.instance_payload(include_missed=False) so missed
instances are omitted from the panel payload (D-009), and returns the
shape documented by the PanelSnapshotResponse models in OpenAPI.

Tests (tests/test_api_panel.py) seed the household through the SAME
nestquest_core.* copy the app uses, pin the route's single clock read,
and assert 401 for missing/wrong/malformed tokens, 200 with the full
documented payload (children in sort order, counts, presence,
cycle_day), and that a past-due open (missed) instance never reaches
the payload.

tests/test_api_health.py

@@ -69,7 +69,12 @@ class _AppRunner:
     """
 
     def __init__(self, db_path: str) -> None:
-        self.app = create_app(ApiConfig(db_path=db_path))
+        # The token value is irrelevant to these tests (the health
+        # route is unauthenticated); it just satisfies the required
+        # field — the panel token's own tests live in test_api_panel.py.
+        self.app = create_app(
+            ApiConfig(db_path=db_path, panel_token="health-runner-token")
+        )
 
     async def __aenter__(self) -> httpx.AsyncClient:
         self._lifespan = self.app.router.lifespan_context(self.app)
@@ -97,9 +102,15 @@ async def app_client(temp_db_path: str) -> httpx.AsyncClient:
 
 
 def test_from_env_returns_set_value() -> None:
-    """A set, non-empty NESTQUEST_DB_PATH is returned verbatim."""
-    cfg = ApiConfig.from_env({"NESTQUEST_DB_PATH": "/data/nq.db"})
+    """Set, non-empty env values are returned verbatim."""
+    cfg = ApiConfig.from_env(
+        {
+            "NESTQUEST_DB_PATH": "/data/nq.db",
+            "NESTQUEST_PANEL_TOKEN": "panel-token",
+        }
+    )
     assert cfg.db_path == "/data/nq.db"
+    assert cfg.panel_token == "panel-token"
 
 
 def test_from_env_raises_on_empty_value() -> None:
@@ -283,10 +294,11 @@ _NO_HA_SCRIPT = textwrap.dedent(
 
     # Build the app (the lifespan is NOT run here, so the path is never
     # opened — it just needs to be a non-empty string to satisfy the
-    # fail-fast config check).  Use a temp path so nothing is created.
+    # fail-fast config check).  Use a temp path so nothing is created;
+    # the panel token value is irrelevant to this import-only check.
     app = create_app(ApiConfig(db_path=str(
         Path(tempfile.gettempdir()) / "nq-noha-buildonly.db"
-    )))
+    ), panel_token="noha-import-token"))
     assert app is not None
 
     print("API NO-HA IMPORT OK")