fix(cctv): make the Houston TranStar pack opt-in

TranStar's disclaimer prohibits copying, distribution and external framing
of specific images without TxDOT's prior written permission, so the pack
no longer loads by default. It now uses envOptIn and loads only when
CCTV_HOUSTON_ENABLED=1, the same pattern as NYC DOT and Via Lietuva.

- DATA_SOURCES.md: replace the licence column with the disclaimer's terms
  and a link, and document the opt-in
- Ambient stills for Houston refresh every 3 minutes, matching TranStar's
  stated snapshot cadence
- README, CHANGELOG, CURRENT-STATE and .env.example describe the pack as
  opt-in; the README camera count no longer includes Houston
- Tests cover the default-off and =0 cases and the opted-in catalog path

src/data/cctvHouston.test.mjs

@@ -67,7 +67,10 @@ test('a Houston row maps to a source on the pinned HTTPS frame host', () => {
   assert.equal(source.lon, -95.355711);
   assert.equal(source.feedType, 'image');
   assert.equal(source.sourceKind, 'houston-transtar');
-  assert.equal(source.license, 'Public Houston TranStar traffic camera');
+  assert.equal(
+    source.license,
+    'TranStar disclaimer — redistribution and external framing need TxDOT written permission',
+  );
   assert.equal(source.groundElevationM, HOUSTON_GROUND_ELEVATION_M);
   assert.equal(source.url, HOUSTON_IMAGE_URL(DOWNTOWN_ID));
   assert.equal(source.url, source.snapshotUrl);
@@ -290,6 +293,7 @@ test('a reduced pack cap keeps cameras nearest the metro anchors', async (t) =>
  */
 const runCatalogWithMockedUpstreams = async (t) => {
   const requested = [];
+  t.mock.restoreAll();
   t.mock.method(console, 'log', () => {});
   t.mock.method(console, 'warn', () => {});
   t.mock.method(globalThis, 'fetch', async (url) => {
@@ -320,7 +324,7 @@ test('the Houston lane is wired into the catalog and its loader runs', async (t)
   try {
     delete process.env.CCTV_SOURCES_FILE;
     delete process.env.CCTV_SOURCES_JSON;
-    delete process.env.CCTV_HOUSTON_ENABLED;
+    process.env.CCTV_HOUSTON_ENABLED = '1';
     const { requested, sources } = await runCatalogWithMockedUpstreams(t);
     assert.ok(
       requested.includes(HOUSTON_CAMERAS_URL),
@@ -339,22 +343,25 @@ test('the Houston lane is wired into the catalog and its loader runs', async (t)
   }
 });
 
-test('CCTV_HOUSTON_ENABLED=0 keeps the lane from being loaded at all', async (t) => {
+test('Houston stays unloaded unless CCTV_HOUSTON_ENABLED=1', async (t) => {
   const saved = { ...process.env };
   try {
     delete process.env.CCTV_SOURCES_FILE;
     delete process.env.CCTV_SOURCES_JSON;
-    process.env.CCTV_HOUSTON_ENABLED = '0';
-    const { requested, sources } = await runCatalogWithMockedUpstreams(t);
-    assert.equal(
-      requested.includes(HOUSTON_CAMERAS_URL),
-      false,
-      'the disabled lane never reaches its upstream',
-    );
-    assert.deepEqual(
-      sources.filter((s) => s.cityId === 'houston'),
-      [],
-    );
+    for (const value of [undefined, '0']) {
+      if (value === undefined) delete process.env.CCTV_HOUSTON_ENABLED;
+      else process.env.CCTV_HOUSTON_ENABLED = value;
+      const { requested, sources } = await runCatalogWithMockedUpstreams(t);
+      assert.equal(
+        requested.includes(HOUSTON_CAMERAS_URL),
+        false,
+        'the pack reaches TranStar only after an explicit opt-in',
+      );
+      assert.deepEqual(
+        sources.filter((s) => s.cityId === 'houston'),
+        [],
+      );
+    }
   } finally {
     for (const key of Object.keys(process.env)) {
       if (!(key in saved)) delete process.env[key];

src/data/cctvLod.js

@@ -34,6 +34,8 @@ const PROVIDER_STATIC_REFRESH_MS = Object.freeze({
   'ontario 511': 3 * 60 * 1000,
   // TxDOT publishes roughly once a minute; 3 min matches the other highway packs.
   txdot: 3 * 60 * 1000,
+  // TranStar says snapshots update about every 3 minutes.
+  'houston transtar': 3 * 60 * 1000,
   // Digitraffic publishes a new weathercam frame on each station's
   // collectionInterval, 600 s for every station sampled; polling faster only
   // re-fetches the same JPEG.

src/data/cctvLod.test.mjs

@@ -639,6 +639,7 @@ test('staticFrameRefreshMs follows known pack cadences and bounds explicit value
   assert.equal(staticFrameRefreshMs({ provider: 'Caltrans' }), 180_000);
   assert.equal(staticFrameRefreshMs({ provider: 'Ontario 511' }), 180_000);
   assert.equal(staticFrameRefreshMs({ provider: 'TxDOT' }), 180_000);
+  assert.equal(staticFrameRefreshMs({ provider: 'Houston TranStar' }), 180_000);
   // Digitraffic publishes one weathercam frame per 600 s collection interval.
   assert.equal(staticFrameRefreshMs({ provider: 'Fintraffic' }), 600_000);
   assert.equal(