Add FastAPI wrapper + web console for the iTelescope portal

Read-only API over go.itelescope.net driven by username/password from a .env:
account status (balance/plan/renewal), plan discounts, telescope roster,
per-site weather, per-scope ACP reachability, and reservations (with a pointer
to the Cloudflare-protected live booking system). A dark dashboard GUI is served
on top at /. Booking is intentionally not exposed - it spends real points.

api/README.md

@@ -0,0 +1,44 @@
+# iTelescope API + Console
+
+A small FastAPI wrapper over the iTelescope.net member portal, plus a web GUI on
+top of it. Credentials come from a `.env` file - nothing is hard-coded.
+
+## What it exposes (all read-only)
+
+| Endpoint | What |
+|---|---|
+| `GET /api/health` | is it configured, known site codes |
+| `GET /api/account` | points balance, plan, renewal, membership |
+| `GET /api/plans` | per-scope access discount for the current plan |
+| `GET /api/telescopes` | the telescope roster (from `../data/itelescope-telescopes.csv`) |
+| `GET /api/weather` | safe/unsafe state for all six observatory sites |
+| `GET /api/weather/{site}` | one site (SSO, UDRO, DSC, SRO, AC, EYE) |
+| `GET /api/scope/{tid}/status` | reachability of a scope's own ACP control server |
+| `GET /api/reservations` | legacy reservation grid + pointer to the live system |
+| `GET /api/raw?path=...` | escape hatch: fetch any portal path (read-only) |
+
+The GUI dashboard is at `/`; interactive OpenAPI docs at `/docs`.
+
+## Run
+
+```bash
+cd api
+python -m pip install -r requirements.txt
+cp .env.example .env          # then edit .env with your username/password
+uvicorn main:app --reload
+# open http://127.0.0.1:8000/
+```
+
+## Deliberate omissions
+
+- **Booking is not exposed.** Reservations spend real points, and the live
+  booking system (`lookup.itelescope.online`) is Cloudflare-protected and needs a
+  browser session. If booking is ever added it must sit behind an explicit,
+  confirmed action - see the drain campaign policy in `../CAMPAIGN.md`.
+- Session cookies live only in memory for the running process.
+
+## Notes
+
+- Auth is the portal's WebForms login (viewstate POST) captured in
+  `itelescope_client.py`; the session re-authenticates automatically if it expires.
+- `DataService.svc` methods are WCF (HTTP GET, JSON under a `d` key).