docs: document FleetNow merged dashboard + read-API topology + FIX-D03

- New '3. Map dashboards & read-API' subsection: the three SPAs (liveposition,
  fleetintelligence, fleetnow), how dashboard_api is deployed (standalone bridge
  container, not Coolify), and that FleetNow lives in its own repo.
- FIX-D03: fleetnow CORS origin + the deploy-script strip/guard fixes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -66,6 +66,25 @@ See `docs/CONNECTIONS.md` for the full shape. Summary:
   e.g. `docker ps --filter name=timescale_db --format "{{.Names}}" | head -1`
 - **Env vars:** loaded from `.env` via `env_file` in `docker-compose.yaml`. See `docs/CONNECTIONS.md` for variable names. Never hardcode secrets.
 
+### Map dashboards & read-API
+
+The map UIs read the **`dashboard_api`** service (FastAPI, `dashboard_api_rev.py`) at
+`https://fleetapi.rahamafresh.com` — the stable replacement for the retired n8n webhooks. It serves
+GeoJSON from the `reporting.*` functions (`fn_live_positions`, `fn_vehicle_track`, `fn_trips_for_map`)
++ filter options. **`dashboard_api` is a STANDALONE Traefik-labelled bridge container, NOT Coolify-managed** —
+it bind-mounts the host file `~/dashboard_api/dashboard_api_rev.py` and is (re)deployed by
+`~/deploy_dashboard_api.sh` on the host (an env/CORS change needs a *recreate*, not a restart). Three
+single-page apps consume it:
+
+| Dashboard | What | Hosting |
+|---|---|---|
+| `liveposition.rahamafresh.com` | live positions only | `index.html` in rustfs bucket `liveposition` behind an nginx proxy |
+| `fleetintelligence.rahamafresh.com` | historical trips only | `index.html` in rustfs bucket `fleetintelligence` behind an nginx proxy |
+| `fleetnow.rahamafresh.com` | **merged** live + trips (current best UI) | **own repo** `repo.rahamafresh.com/kianiadee/fleetnow.git`, deployed via **Coolify (Dockerfile → nginx)** |
+
+All three origins must be in the API's `DASHBOARD_CORS_ORIGINS` (see FIX-D03). **FleetNow is the
+single source of truth for the merged map and lives in its own repo — edit it there, not here.**
+
 ---
 
 ## 4. Codebase Map
@@ -210,6 +229,7 @@ dwh_control.v_watermark_lag      -- Grafana: extract vs. load lag per table
 | BUG-02 | Migration 04 | Historical `distance_m` rows ÷1,000,000 → renamed to `distance_km` |
 | FIX-D01 | `dashboard_api_rev.py` | `POST /webhook/fleet-dashboard` read body as JSON, but the SPA posts `x-www-form-urlencoded` → `request.json()` threw, filters silently dropped, map always returned the whole fleet. Now parsed by Content-Type (`parse_qs` for form, JSON still accepted). Commit `f1387d1` |
 | FIX-D02 | `dashboard_api_rev.py` | `reporting.v_trips` matview froze on 2026-06-01 when n8n (which ran the scheduled refresh) was retired → dashboard showed "no trips". Added an in-process background refresher (`REFRESH MATERIALIZED VIEW CONCURRENTLY` every `VTRIPS_REFRESH_INTERVAL_S`, default 300s; pg advisory-lock guarded for `--workers`; logs to `reporting.refresh_log` source=`dashboard_api`). Commit `30b3515` |
+| FIX-D03 | `dashboard_api_rev.py`, `~/deploy_dashboard_api.sh` (host) | Added `https://fleetnow.rahamafresh.com` to `DASHBOARD_CORS_ORIGINS` default for the merged **FleetNow** dashboard. The standalone bridge container inherits its env from `webhook_receiver`, which already carries the old two-origin value — so the deploy script's *conditional* append never fired. The script now **strips any inherited `DASHBOARD_CORS_ORIGINS` and sets all three origins unconditionally**, and **guards the `mv`** so a missing staged `dashboard_api_rev.py` doesn't abort the run under `set -e` (env changes need a container *recreate*, not a restart). Commit `d95e5c2` |
 
 ---
 

dashboard_api_rev.py

@@ -54,7 +54,7 @@ _ALLOWED_ORIGINS = [
     o.strip()
     for o in os.getenv(
         "DASHBOARD_CORS_ORIGINS",
-        "https://liveposition.rahamafresh.com,https://fleetintelligence.rahamafresh.com",
+        "https://liveposition.rahamafresh.com,https://fleetintelligence.rahamafresh.com,https://fleetnow.rahamafresh.com",
     ).split(",")
     if o.strip()
 ]