feat: finish forecast rendering and account-authenticated API explorer

tests/test_weather.py

@@ -125,3 +125,13 @@ def test_image_url_allowlist_is_persistent_and_restrictive(client, service):
     ).json()["allowed_hosts"] == ["example.com"]
     assert service.settings.image_url_hosts == ["example.com"]
     assert service.db.one("SELECT payload FROM app_config WHERE key='image_url_hosts'")
+
+
+def test_weather_template_resolves_forecast(service):
+    provider = ConfigurableWeatherProvider(service.db, transport())
+    provider.configure(WeatherConfig(provider="open-meteo"))
+    service.renderer.weather = provider
+    snapshot = service.renderer.resolve("weather", {})
+    assert snapshot["forecast"][0]["maximum_c"] == 26
+    assert snapshot["weather_attribution"] == "Open-Meteo / CC BY 4.0"
+    assert service.renderer.render("weather", snapshot)