fix(cctv): make the Houston TranStar pack opt-in

TranStar's disclaimer prohibits copying, distribution and external framing
of specific images without TxDOT's prior written permission, so the pack
no longer loads by default. It now uses envOptIn and loads only when
CCTV_HOUSTON_ENABLED=1, the same pattern as NYC DOT and Via Lietuva.

- DATA_SOURCES.md: replace the licence column with the disclaimer's terms
  and a link, and document the opt-in
- Ambient stills for Houston refresh every 3 minutes, matching TranStar's
  stated snapshot cadence
- README, CHANGELOG, CURRENT-STATE and .env.example describe the pack as
  opt-in; the README camera count no longer includes Houston
- Tests cover the default-off and =0 cases and the opted-in catalog path

changelog.d/1125-houston-cctv-pack.md

@@ -0,0 +1,13 @@
+- Add Houston traffic cameras from Houston TranStar as a CCTV pack. The camera
+  list is one keyless JSON request to
+  `traffic.houstontranstar.org/data/layers/cctvSnapshots_json.js`; frames are
+  stills synthesized from each numeric camera id on `www.houstontranstar.org`,
+  so a catalog field cannot steer the proxy off-host. Cameras without a
+  snapshot id, and cameras outside Greater Houston, are dropped. TranStar's
+  disclaimer prohibits redistribution and external framing without TxDOT's
+  written permission, so the pack is off unless `CCTV_HOUSTON_ENABLED=1`.
+  Opting in loads the 250 cameras nearest downtown, Uptown, the Medical
+  Center, IAH and Galveston; `CCTV_HOUSTON_MAX_SOURCES` changes that cap.
+  Snapshots update about every 3 minutes. The catalog-wide ceiling is
+  unchanged; extra cameras share it round-robin with the other packs
+  (mvanhorn, #1125).