feat: demo CORS, demo client, openpyxl catalog load

- Load consumable catalog XLSX with openpyxl and drop the pandas dependency.
- Add optional demo CORS settings and FastAPI CORSMiddleware for browser clients.
- Add scripts/demo_client static page and local server for API smoke tests.

Made-with: Cursor

app/config.py

@@ -135,6 +135,20 @@ class Settings(BaseSettings):
     #: 上传医生语音 WAV 的最大字节数（默认 10MB）。
     voice_upload_max_bytes: int = Field(default=10 * 1024 * 1024, ge=64, le=50 * 1024 * 1024)
 
+    # --- Demo 客户端跨源（仅用于 scripts/demo_client 联调；生产置 false） ---
+    #: 为 true 时挂载 CORSMiddleware，便于浏览器 demo 从另一个端口访问本服务。
+    demo_cors_enabled: bool = True
+    #: 逗号分隔的允许来源；`*` 表示允许全部来源（demo/联调用，生产应显式指定）。
+    demo_cors_origins: str = "*"
+
+    def parsed_demo_cors_origins(self) -> list[str]:
+        raw = (self.demo_cors_origins or "").strip()
+        if not raw:
+            return []
+        if raw == "*":
+            return ["*"]
+        return [item.strip() for item in raw.split(",") if item.strip()]
+
     @field_validator("consumable_classifier_weights", mode="before")
     @classmethod
     def consumable_classifier_weights_default(cls, value: object) -> str: