fix(noaa): severe weather always reported zero — /alerts/active rejects limit

`getActiveAlerts()` always sent `limit` to `api.weather.gov/alerts/active`,
which the endpoint does not accept. The upstream reply is explicit:

    HTTP 400
    {"parameter": "query.limit",
     "message": "Query parameter \"limit\" is not recognized"}

`safeFetch` resolves to `{ error }` rather than throwing, so `alerts?.features
|| []` collapsed to an empty array and the source reported a confident
all-clear on every sweep since the parameter was added:

    "totalSevereAlerts": 0,
    "summary": { "hurricanes": 0, "tornadoes": 0, "floods": 0,
                 "winterStorms": 0, "wildfires": 0, "other": 0 }

with no error field anywhere in the payload. At the time of this commit the
same query without `limit` returns 33 active severe alerts, including a live
Severe Thunderstorm Warning and 26 Extreme Heat Warnings.

Drop the parameter. `/alerts/active` only ever returns currently-active
alerts, so the response is naturally bounded and no client-side cap is
needed — capping would under-report `totalSevereAlerts` during exactly the
severe-weather outbreaks this source exists to catch.

Also pass through `alerts.error` so a future upstream failure is visible in
the payload instead of silently rendering as "no severe weather anywhere in
the US". Same bug class, four lines; happy to split it out if preferred.

Verified: 0 -> 33 alerts against the live API; forced-failure path now
surfaces the error; `node --test test/*.test.mjs` 45 pass / 1 skipped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: YAMRAJ13y

apis/sources/noaa.mjs

@@ -11,10 +11,12 @@ export async function getActiveAlerts(opts = {}) {
     severity = null,  // Extreme, Severe, Moderate, Minor
     urgency = null,   // Immediate, Expected, Future
     event = null,     // e.g. "Tornado Warning", "Hurricane Warning"
-    limit = 50,
   } = opts;
 
-  const params = new URLSearchParams({ limit: String(limit), status: 'actual' });
+  // /alerts/active does not accept `limit` — sending it fails the whole request
+  // with HTTP 400 ("Query parameter \"limit\" is not recognized"). The endpoint
+  // only returns currently-active alerts, so the response is naturally bounded.
+  const params = new URLSearchParams({ status: 'actual' });
   if (severity) params.set('severity', severity);
   if (urgency) params.set('urgency', urgency);
   if (event) params.set('event', event);
@@ -48,6 +50,10 @@ export async function briefing() {
   return {
     source: 'NOAA/NWS',
     timestamp: new Date().toISOString(),
+    // Surface upstream failures rather than reporting a confident all-clear.
+    // safeFetch resolves to { error } instead of throwing, so without this a
+    // failed request looks identical to "no severe weather anywhere in the US".
+    ...(alerts?.error ? { error: alerts.error } : {}),
     totalSevereAlerts: features.length,
     summary: {
       hurricanes: hurricanes.length,