Cache-safe opening hours — compute state client-side

Fixes restaurant showing "We're Closed" during open hours on cached pages.

Root cause: DD_Hours::get_state() was computed server-side and baked into page HTML. QUIC.cloud served a snapshot cached while the restaurant was closed, so every visitor saw closed buttons all day regardless of the real state.

Fix: window.DD now carries the static schedule (hours_schedule, hours_tz, closing_soon_min) instead of a computed state. New assets/js/hours.js derives state, close_ts and next_open_ts in the browser on load and re-checks every 60s. Schedule only changes when settings change, so the payload is cache-safe.

Server-side enforcement in dd_cart_add is unchanged and remains the authoritative gate. JS failure modes fail open.