fix(cctv): key-gate Ottawa, opt-in Québec video, keep shared slots

Review fixes for #1506.

- Ottawa: use the documented camera list and the city's Traffic Camera
  Images API. The pack is skipped with no request unless
  OTTAWA_CAMERA_CERTIFICATE is set; the certificate is added only at
  fetch time inside the pinned /opendata/ path, and each camera is
  fetched at most once a minute through the shared frame cache.
- Québec 511 video is opt-in (CCTV_QUEBEC_VIDEO_ENABLED=1) and loads
  only after the viewer presses Play; selection, auto-hop, scenes and
  voice no longer contact Québec 511. Credit splits locations (MTQ,
  CC BY 4.0) from video (Québec 511). Interrupted play() is no longer
  reported as an unavailable source; the per-frame listener runs only
  while a Québec camera is selected and the canvas rect is cached.
- Catalog cap: reserved Québec and World slots come only from capacity
  above the 4,000 shared slots, so a lower CCTV_MAX_SOURCES thins every
  pack instead of starving the existing ones. dev-fresh and
  .env.example default to 7,516.
- Throttled frames (World, Ottawa): inside the refresh floor with no
  cached frame the proxy serves the placeholder, never Street View; a
  failed fetch backs off for a minute; the cache is bounded by bytes.
- MJPEG first-frame extraction runs only for sources registered as
  MJPEG (Taiwan Highway Bureau), caps a frame at 2 MB, reads in linear
  time, accepts a CRLF preamble and a boundary that already starts with
  "--", and ends a part without Content-Length at the next delimiter.
  THB hosts are registered in the redirect pin list.
- Tests: World loader policy, Québec loader and opt-in, proxy cooldown
  without Street View, Ottawa signing, cap reservations at 7,516, 4,000
  and 48, overlay Play gate, refresh, visibility and teardown. Guard
  tests check the 4,000 shared slots again.
- Remove the unused standalone Québec preview module and public page.
- Docs: DATA_SOURCES, SECURITY, CURRENT-STATE, CCTV_INTEGRATION, README,
  .env.example, changelog fragment renamed to its full scope.

docs/CCTV_INTEGRATION.md

@@ -15,8 +15,12 @@ media URL permitted by the exception below.
   restricted.
 - Prefer a public, keyless feed. If credentials are required, keep them in a
   server-only environment variable; never put a secret in browser code or a
-  Vite-exposed variable. If access terms require an agreement or remain
-  unconfirmed, make the pack opt-in and ensure it makes no request by default.
+  Vite-exposed variable. A pack that needs a key is opt-in by that key: with
+  the variable unset it makes no request and logs once (Ontario 511 and
+  Ottawa). Keep the key out of catalog URLs and add it only at fetch time. Use
+  the provider's documented API, not a website endpoint that skips its key. If
+  access terms require an agreement or remain unconfirmed, make the pack
+  opt-in and ensure it makes no request by default.
 - Confirm the feed can be fetched from the app's Node server environment. A URL
   opening in a browser does not prove the server can reach it, and browser CORS
   behavior does not diagnose a server-side fetch.
@@ -94,8 +98,11 @@ Catalog and media loaders must also:
 For live media, prefer the existing proxy and supported feed type (`mjpeg`,
 `mp4`, `webm`, or `hls`). A direct browser-only video is a narrow fallback for
 a source whose terms allow embedding when the browser can play it but the app
-server cannot fetch it. Build its URL from a validated provider ID on the
-server; never accept a browser-supplied media URL. Render it in a native DOM
+server cannot fetch it. Unconfirmed embedding terms make it opt-in like any
+other pack, and the browser loads it only after an explicit play action, never
+on selection, because the provider sees the viewer's IP address. Build its URL
+from a validated provider ID on the server; never accept a browser-supplied
+media URL. Render it in a native DOM
 `<video>` without `crossOrigin`, and do not read its pixels into canvas, WebGL,
 or a Cesium texture. If a map preview is needed, a second video request may be
 paused as a DOM overlay at the camera location; label it as an approximate