Cameras: redact API keys from feed errors; gate TfL/Calgary; clamp map bbox

- Feed/catalog error text (shown to every signed-in user via GET /cameras and
  /traffic/511 status fields) carried httpx's full request URL, including
  ?key= for Ontario 511 and the 511NY DAA key. Query strings are now dropped.
- TfL and Calgary licences are per GEV only (TfL's terms page 403'd), the same
  footing as Ontario 511, so they are UNVERIFIED (acknowledgement required)
  instead of ungated attribution_required. Attribution still renders.
- The map camera layer clamps its bbox to +/-180/+/-90; zoomed-out bounds
  produced a 422 ("could not reach server").

Refs server-26#198

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/app/internal/cameras/base.py

@@ -147,7 +147,7 @@ class Catalog:
                 self._next_attempt = time.time() + ttl
             except Exception as e:
                 self._next_attempt = time.time() + min(ttl, RETRY_AFTER_FAILURE_S)
-                self.error = f"{type(e).__name__}: {e}"[:300]
+                self.error = safe_error(e)
                 logger.warning(f"cameras/{self.provider.meta.id}: refresh failed, serving {len(self.items)} cached: {self.error}")
         return self
 
@@ -158,6 +158,17 @@ class Catalog:
 
 # ── helpers shared by adapters ───────────────────────────────────────────────
 
+# Query strings are where API keys travel (?key=...). httpx puts the full URL in
+# HTTPStatusError text, and this text reaches every signed-in user through the
+# status fields of GET /cameras and /traffic/511, so it is dropped here.
+_URL_QUERY = re.compile(r"(https?://[^\s'\"?#]+)\?[^\s'\"#]*")
+
+
+def safe_error(e: BaseException) -> str:
+    """Error text safe to show users: URL query strings removed, length capped."""
+    return _URL_QUERY.sub(r"\1?[redacted]", f"{type(e).__name__}: {e}")[:300]
+
+
 def make_camera(provider_id: str, raw_id: Any, lat: float, lon: float, *, name: str = "", roadway: str = "",
                 direction: str = "", image_url: Optional[str] = None, video_url: Optional[str] = None,
                 heading_deg: Optional[float] = None) -> Camera:

drb-c2-core/app/internal/cameras/general.py

@@ -177,9 +177,12 @@ class CalgaryProvider(CameraProvider):
     meta = ProviderMeta(
         id="calgary", name="Open Calgary traffic cameras", region="Calgary, Alberta",
         coverage=(50.8, -114.5, 51.3, -113.8),
+        # UNVERIFIED like Ontario 511: the OGL - Calgary grant is per GEV, not read
+        # first-hand (camera-sources.md: "Yes, attribution (per GEV)"), so it is gated.
         licence=LicenceInfo(
-            status=Licence.ATTRIBUTION_REQUIRED, label="Commercial OK with attribution (OGL - City of Calgary)",
-            terms="Open Government Licence - City of Calgary: reuse permitted with attribution.",
+            status=Licence.UNVERIFIED,
+            label="Licence UNVERIFIED -- OGL - City of Calgary per GEV, terms page not read first-hand",
+            terms="Open Government Licence - City of Calgary (reuse with attribution) per GEV; not confirmed first-hand.",
             terms_url="https://data.calgary.ca/stories/s/Open-Calgary-Terms-of-Use/u45n-7awa",
             attribution="Contains information licensed under the Open Government Licence - City of Calgary",
             attribution_url="https://data.calgary.ca"),
@@ -215,9 +218,11 @@ class TflProvider(CameraProvider):
     meta = ProviderMeta(
         id="tfl", name="TfL JamCams", region="London, UK",
         coverage=(51.2, -0.7, 51.8, 0.4),
+        # UNVERIFIED: the TfL terms page 403'd during the survey and the grant is
+        # per GEV only (camera-sources.md: "re-read"), so it is gated until re-read.
         licence=LicenceInfo(
-            status=Licence.ATTRIBUTION_REQUIRED,
-            label="Commercial OK with attribution (\"Powered by TfL Open Data\") -- TfL terms page not re-read",
+            status=Licence.UNVERIFIED,
+            label="Licence UNVERIFIED -- commercial OK with attribution per GEV; TfL terms page not read first-hand",
             terms="TfL transport data terms: free incl. commercial, with attribution (per GEV; the terms page "
                   "returned 403 during the survey -- re-read before selling).",
             terms_url="https://tfl.gov.uk/info-for/open-data-users/our-open-data",

drb-c2-core/app/internal/ny511.py

@@ -38,6 +38,7 @@ import httpx
 
 from app.config import settings
 from app.internal.logger import logger
+from app.internal.cameras.base import safe_error
 
 LEGACY_BASE = "https://511ny.org/api"
 CAMERAS_TTL_S = 60 * 60   # camera list is near-static
@@ -73,7 +74,7 @@ class _Feed:
                 self._next_attempt = time.time() + self.ttl_s
             except Exception as e:
                 self._next_attempt = time.time() + min(self.ttl_s, RETRY_AFTER_FAILURE_S)
-                self.error = f"{type(e).__name__}: {e}"[:300]
+                self.error = safe_error(e)   # never echo ?key= to viewers
                 logger.warning(f"511NY {self.path} refresh failed, serving {len(self.items)} cached: {self.error}")
         return self