feat: demo CORS, demo client, openpyxl catalog load

- Load consumable catalog XLSX with openpyxl and drop the pandas dependency.
- Add optional demo CORS settings and FastAPI CORSMiddleware for browser clients.
- Add scripts/demo_client static page and local server for API smoke tests.

Made-with: Cursor

main.py

@@ -3,9 +3,11 @@ from contextlib import asynccontextmanager
 
 import uvicorn
 from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
 from loguru import logger
 
 from app.api import router as api_router
+from app.config import settings
 from app.database import check_database, engine, init_db_schema
 from app.dependencies import camera_session_manager
 
@@ -33,6 +35,17 @@ def create_app() -> FastAPI:
         title="Operation Room Monitor",
         lifespan=lifespan,
     )
+    if settings.demo_cors_enabled:
+        origins = settings.parsed_demo_cors_origins()
+        if origins:
+            application.add_middleware(
+                CORSMiddleware,
+                allow_origins=origins,
+                allow_credentials=origins != ["*"],
+                allow_methods=["*"],
+                allow_headers=["*"],
+            )
+            logger.info("CORS enabled for demo client; origins={}", origins)
     application.include_router(api_router)
     return application