Gate /api/show/lvgmc-forecast behind ENABLE_LVGMC_FTP_JOBS too

Caught by an independent follow-up review: the FTP auth-bypass fix in
6b9c7cf only gated /api/fetch/lvgmc/stations, the one route the original
security review named. This sibling route calls the same fetch.fetchFile,
which opens a real, unauthenticated FTP login to LVGMC regardless of any
caller-supplied filename, and was only getting the traversal fix
(ValidateFileName) applied to it, not the auth-bypass fix. Traced every
caller of fetch.fetchFile/fetchWeatherStations in Server.scala/Main.scala
this time to confirm these are the only two HTTP-reachable call sites and
both are now gated.

src/main/scala/server/Server.scala

@@ -64,10 +64,18 @@ class Server(postgresService: PostgresService, dataService: DataService, fetch:
         }
 
     // http://0.0.0.0:8080/api/show/lvgmc-forecast/Latvija_LTV_pilsetas_tekosa_dn.csv
+    // Gated behind the same flag as the scheduled FTP task and
+    // /fetch/lvgmc/stations below: fetch.fetchFile opens a real FTP login to
+    // LVGMC regardless of any caller-supplied filename, so an unauthenticated
+    // caller could otherwise trigger unlimited outbound FTP sessions no
+    // matter what ENABLE_LVGMC_FTP_JOBS says.
     case GET -> Root / "show" / "lvgmc-forecast" / ValidateFileName(fileName) =>
+      if (sys.env.get("ENABLE_LVGMC_FTP_JOBS").exists(_.equalsIgnoreCase("true")))
         fetch.fetchFile(fileName).flatMap(bytes =>
           Ok(bytes).map(_.withContentType(`Content-Type`(MediaType.text.csv)))
         )
+      else
+        ServiceUnavailable("LVGMC FTP fetching is currently disabled")
 
     // http://0.0.0.0:8080/api/fetch/lvgmc/stations
     // Gated behind the same flag as the scheduled FTP task: this route would