Fix: hours banner expired-nonce 403

Removed the nonce check from dd_get_hours_state (the AJAX endpoint the closed/closing-soon banner fetches fresh on every load) and stopped sending one from the client. That nonce was baked into the same cached page HTML the endpoint exists to route around — once a page's LiteSpeed/QUIC.cloud cache entry outlived the nonce's ~24h lifetime, the AJAX call silently 403'd and the banner never rendered, with no console error. The handler takes no input parameters, is read-only, and returns only what's already public in every page's own HTML (open/closed state + timestamps) — nothing was actually being protected. No other nonce-protected endpoint (cart, orders, reservations) touched.