fix(cinny): restore gifApiKey placeholder + redact leaked key from README

The production config.json (cp'd from cinny/config.json by deploy/lxc106-cinny.sh)
lost its "gifApiKey": "" placeholder, so lotus_deploy.sh's sed injection had no
field to fill -> the GIF composer button disappeared (it renders only when
gifApiKey is non-empty). Restore the placeholder so future deploys inject the key.

Also redact the real Giphy key that was committed in the README (it belongs only in
/etc/lotus-deploy.env on LXC 106). NOTE: the key remains in git history (commit
f3a7bcd) — it should be rotated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -533,9 +533,13 @@ All custom code lives in `src/app/` on the `lotus` branch of `code.lotusguild.or
   "defaultHomeserver": 0,
   "homeserverList": ["matrix.lotusguild.org"],
   "allowCustomHomeservers": false,
-  "gifApiKey": "AqqDuQwZNjYttz7Mn6ME4JH1bJIuZ5CO"
+  "gifApiKey": ""
 }
 ```
+> **Note:** `gifApiKey` is a runtime secret — it is **not** stored in git. The placeholder
+> ships empty; `lotus_deploy.sh` injects the real key from `GIPHY_API_KEY` in
+> `/etc/lotus-deploy.env` on LXC 106 after each deploy. (For that injection to work the
+> deployed `config.json` must contain the `"gifApiKey": ""` placeholder line.)
 
 > Note: The root `/opt/lotus-cinny/config.json` is what matters — vite copies it to `dist/`. `public/config.json` is not used.
 

cinny/config.json

@@ -15,5 +15,6 @@
   "hashRouter": {
     "enabled": false,
     "basename": "/"
-  }
+  },
+  "gifApiKey": ""
 }