Merge pull request 'Weather backend: NWS active alerts + nearest-METAR wind, cached (Refs #237)' (#263) from feat/237-weather-api into main

infra/ansible/roles/deploy/templates/c2-core.env.j2

@@ -44,3 +44,8 @@ AGENT_SERVICE_KEY={{ vault_agent_service_key | default('') }}
 # frontend call to the API would have failed CORS. If the frontend ever moves
 # to app.{{ domain }}, change this at the same time.
 CORS_ORIGINS=["https://{{ domain }}"]
+
+# NWS weather alerts / METAR wind (server-26#237). api.weather.gov requires a
+# User-Agent naming the app and a contact; default to the site URL so a vault
+# that predates this key still sends an identifiable agent, not the placeholder.
+NWS_USER_AGENT={{ vault_nws_user_agent | default('DRB scanner map (https://' ~ domain ~ ')', true) }}

infra/ansible/vault.yml.example

@@ -60,3 +60,5 @@ vault_firebase_app_id: ""
 
 # No GCP key needed — the VM uses Application Default Credentials via the
 # GCE metadata server. Terraform grants the required IAM roles at apply time.
+
+vault_nws_user_agent: ""        # optional; e.g. "DRB scanner map (ops@yourdomain)" -- blank/absent uses the site URL