Weather backend: NWS active alerts + nearest-METAR wind, cached (Refs #237)

GET /weather/alerts — api.weather.gov/alerts/active for settings.nws_area,
sent with the NWS-required User-Agent, cached weather_alerts_ttl_s (90 s)
with single-flight refresh. Zone-based alerts (geometry null) get their
polygons from affectedZones (24 h zone cache, api.weather.gov/zones/ only);
any still unresolved are returned in zone_only, never dropped. Failed
refresh keeps last-good data + error + fetched_at; a payload where no
feature parses is a schema-change error. Optional bbox filter.

GET /weather/wind — nearest METAR (aviationweather.gov /api/data/metar,
bbox query) within 75 km, cached 5 min per 0.5-degree cell; VRB wind and
stale reports flagged; available:false with a reason otherwise.

Both behind require_service_or_firebase_token like /traffic.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/app/config.py

@@ -59,6 +59,14 @@ class Settings(BaseSettings):
     # Camera providers (app/internal/cameras). Keys only; every provider is still
     # OFF until an admin enables it, and licence-gated ones need an acknowledgement.
     ontario511_api_key: Optional[str] = None
+    # Weather context (server-26#237). api.weather.gov requires a User-Agent that
+    # names the app AND a contact (e.g. "DRB (ops@example.com)"); the placeholder
+    # default must be overridden in every deploy -- NWS may block anonymous agents.
+    nws_user_agent: str = "DRB scanner map (contact: set NWS_USER_AGENT)"
+    # Comma list of NWS state/marine area codes for /alerts/active (the areas served).
+    nws_area: str = "NY"
+    # NWS alerts cache TTL; the issue asks 60-120 s (floored at 30 s in code).
+    weather_alerts_ttl_s: int = 90
 
     # Gemini (intelligence extraction, embeddings, incident summaries)
     gemini_api_key: Optional[str] = None