Weather review fixes: zone-fetch time budget, prod NWS_USER_AGENT (Refs #237)

- Cap one refresh's NWS zone fetches at 15 s wall clock. They run under the
  feed lock, so a hung zone endpoint could otherwise stall every
  /weather/alerts request for minutes; unfinished zones retry next refresh.
- Prod c2-core.env.j2 never set NWS_USER_AGENT, so the VM would have sent the
  contact-less placeholder. Default it to the site URL (overridable via
  vault_nws_user_agent); warn on the .env.example example.com placeholder too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/ansible/vault.yml.example

@@ -60,3 +60,5 @@ vault_firebase_app_id: ""
 
 # No GCP key needed — the VM uses Application Default Credentials via the
 # GCE metadata server. Terraform grants the required IAM roles at apply time.
+
+vault_nws_user_agent: ""        # optional; e.g. "DRB scanner map (ops@yourdomain)" -- blank/absent uses the site URL