WIP: list credits for all serving providers; pin 511NY imagery to https

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/tests/test_camera_providers.py

@@ -148,8 +148,12 @@ def test_query_returns_attribution_and_skips_providers_outside_bbox(store):
             patch.object(registry.PROVIDERS["tfl"], "fetch_catalog", tfl_fetch):
         out = run(registry.cameras_in_bbox((-34.0, 151.0, -33.7, 151.4)))
     assert [c["id"] for c in out["cameras"]] == ["nsw:x"]
-    assert out["providers"][0]["attribution"] == "Transport for NSW, CC BY 4.0"
+    by_id = {p["id"]: p for p in out["providers"]}
+    assert by_id["nsw"]["attribution"] == "Transport for NSW, CC BY 4.0"
     assert tfl_fetch.await_count == 0   # London never fetched for a Sydney bbox
+    # ...but its credit is still listed, for cameras the client holds from another view
+    assert by_id["tfl"]["attribution"] == "Powered by TfL Open Data" and by_id["tfl"]["total_in_bbox"] == 0
+    assert out["serving_count"] == 2
 
 
 # ── admin routes ─────────────────────────────────────────────────────────────
@@ -263,10 +267,11 @@ def test_ontario_needs_its_key(monkeypatch):
 
 def test_ny511_provider_wraps_legacy_client_and_carries_daa_metadata():
     row = {"id": "NYSDOT-1", "lat": 41.03, "lon": -73.76, "name": "I-287", "roadway": "I-287",
-           "direction": "Northbound", "image_url": "https://x/1", "video_url": None}
+           "direction": "Northbound", "image_url": "https://x/1", "video_url": "javascript:alert(1)"}
     with patch.object(regional.ny511, "_fetch", AsyncMock(return_value=[row])):
         cams = run(regional.Ny511Provider().fetch_catalog())
     assert cams[0]["id"] == "ny511:NYSDOT-1" and cams[0]["heading_deg"] == 0
+    assert cams[0]["video_url"] is None   # non-https never reaches the browser
     lic = regional.Ny511Provider.meta.licence
     assert lic.attribution == "powered by 511NY" and lic.attribution_url == "https://511ny.org"
     assert "with all faults" in lic.disclaimer and lic.gated