fix(cinny): restore gifApiKey placeholder + redact leaked key from README

The production config.json (cp'd from cinny/config.json by deploy/lxc106-cinny.sh)
lost its "gifApiKey": "" placeholder, so lotus_deploy.sh's sed injection had no
field to fill -> the GIF composer button disappeared (it renders only when
gifApiKey is non-empty). Restore the placeholder so future deploys inject the key.

Also redact the real Giphy key that was committed in the README (it belongs only in
/etc/lotus-deploy.env on LXC 106). NOTE: the key remains in git history (commit
f3a7bcd) — it should be rotated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cinny/config.json

@@ -15,5 +15,6 @@
   "hashRouter": {
     "enabled": false,
     "basename": "/"
-  }
+  },
+  "gifApiKey": ""
 }