Disable backend-sim workflow, remove generated files, fix CORS misconfiguration

[Copilot]

The backend-sim workflow was committing auto-generated simulation data (api/status.json, api/history.json) to the repo on a 6-hour schedule and via manual dispatch. Additionally, proxy.py had an invalid CORS configuration pairing allow_origins=["*"] with allow_credentials=True, which browsers reject per the CORS spec.

Changes

• backend-sim.yml — Replaced schedule + workflow_dispatch triggers with on: workflow_call: (never invoked), effectively disabling the workflow while keeping valid YAML. Original triggers preserved in comments for easy re-enabling.
• api/status.json, api/history.json — Deleted workflow-generated files and the now-empty api/ directory.
• proxy.py — Set allow_credentials=False to fix the wildcard-origin + credentials CORS conflict:

# Before — browsers reject this combination
app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_credentials=True, ...)

# After
app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_credentials=False, ...)