Cameras: redact API keys from feed errors; gate TfL/Calgary; clamp map bbox

- Feed/catalog error text (shown to every signed-in user via GET /cameras and
  /traffic/511 status fields) carried httpx's full request URL, including
  ?key= for Ontario 511 and the 511NY DAA key. Query strings are now dropped.
- TfL and Calgary licences are per GEV only (TfL's terms page 403'd), the same
  footing as Ontario 511, so they are UNVERIFIED (acknowledgement required)
  instead of ungated attribution_required. Attribution still renders.
- The map camera layer clamps its bbox to +/-180/+/-90; zoomed-out bounds
  produced a 422 ("could not reach server").

Refs server-26#198

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/app/internal/cameras/base.py

@@ -147,7 +147,7 @@ class Catalog:
                 self._next_attempt = time.time() + ttl
             except Exception as e:
                 self._next_attempt = time.time() + min(ttl, RETRY_AFTER_FAILURE_S)
-                self.error = f"{type(e).__name__}: {e}"[:300]
+                self.error = safe_error(e)
                 logger.warning(f"cameras/{self.provider.meta.id}: refresh failed, serving {len(self.items)} cached: {self.error}")
         return self
 
@@ -158,6 +158,17 @@ class Catalog:
 
 # ── helpers shared by adapters ───────────────────────────────────────────────
 
+# Query strings are where API keys travel (?key=...). httpx puts the full URL in
+# HTTPStatusError text, and this text reaches every signed-in user through the
+# status fields of GET /cameras and /traffic/511, so it is dropped here.
+_URL_QUERY = re.compile(r"(https?://[^\s'\"?#]+)\?[^\s'\"#]*")
+
+
+def safe_error(e: BaseException) -> str:
+    """Error text safe to show users: URL query strings removed, length capped."""
+    return _URL_QUERY.sub(r"\1?[redacted]", f"{type(e).__name__}: {e}")[:300]
+
+
 def make_camera(provider_id: str, raw_id: Any, lat: float, lon: float, *, name: str = "", roadway: str = "",
                 direction: str = "", image_url: Optional[str] = None, video_url: Optional[str] = None,
                 heading_deg: Optional[float] = None) -> Camera: