fix(cctv): make the NYC DOT pack opt-in and carry DOT's disclaimer

NYC DOT asks developers who use its camera feed to sign a data-sharing
agreement, and this project does not hold one that covers downstream
installs. The pack now loads only when CCTV_NYC_ENABLED=1; unset, empty
or any other value makes no request to webcams.nyctmc.org (tested).

The NYC credit carries NYC DOT's requested application disclaimer
verbatim, and DATA_SOURCES, README, CHANGELOG, CURRENT-STATE and
.env.example describe the prerequisite.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CHANGELOG.md

@@ -1,12 +1,14 @@
 # Changelog
 
 - Add New York City traffic cameras from the NYC DOT Traffic Management Center
-  as a CCTV pack. The camera list is one keyless JSON request to
+  as an opt-in CCTV pack. NYC DOT requires a data-sharing agreement for the
+  camera feed, so the pack is off unless `CCTV_NYC_ENABLED=1` is set by an
+  operator who holds one; otherwise no request reaches NYC DOT. NYC DOT's
+  requested disclaimer is in the Data attribution popover. The camera list is one keyless JSON request to
   `webcams.nyctmc.org/api/cameras`; frames are stills synthesized from each
   camera UUID on that same host, so a catalog field cannot steer the proxy
-  off-host. Offline cameras are dropped. By default the 250 cameras nearest
-  the five borough cores load. `CCTV_NYC_ENABLED=0` turns the pack off and
-  `CCTV_NYC_MAX_SOURCES` changes the cap. The catalog-wide ceiling is
+  off-host. Offline cameras are dropped. Once enabled, the 250 cameras nearest
+  the five borough cores load and `CCTV_NYC_MAX_SOURCES` changes the cap. The catalog-wide ceiling is
   unchanged; extra cameras share it round-robin with the other packs.
 
 - Treat explicitly current, complete empty vessel coverage as a successful update,