Cameras: redact API keys from feed errors; gate TfL/Calgary; clamp map bbox

- Feed/catalog error text (shown to every signed-in user via GET /cameras and
  /traffic/511 status fields) carried httpx's full request URL, including
  ?key= for Ontario 511 and the 511NY DAA key. Query strings are now dropped.
- TfL and Calgary licences are per GEV only (TfL's terms page 403'd), the same
  footing as Ontario 511, so they are UNVERIFIED (acknowledgement required)
  instead of ungated attribution_required. Attribution still renders.
- The map camera layer clamps its bbox to +/-180/+/-90; zoomed-out bounds
  produced a 422 ("could not reach server").

Refs server-26#198

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/app/internal/ny511.py

@@ -38,6 +38,7 @@ import httpx
 
 from app.config import settings
 from app.internal.logger import logger
+from app.internal.cameras.base import safe_error
 
 LEGACY_BASE = "https://511ny.org/api"
 CAMERAS_TTL_S = 60 * 60   # camera list is near-static
@@ -73,7 +74,7 @@ class _Feed:
                 self._next_attempt = time.time() + self.ttl_s
             except Exception as e:
                 self._next_attempt = time.time() + min(self.ttl_s, RETRY_AFTER_FAILURE_S)
-                self.error = f"{type(e).__name__}: {e}"[:300]
+                self.error = safe_error(e)   # never echo ?key= to viewers
                 logger.warning(f"511NY {self.path} refresh failed, serving {len(self.items)} cached: {self.error}")
         return self