chore: decide and document Giphy API key distribution model

[krwg]

Summary

giphy-api-key.txt shipped beside the executable is extractable from the installer. Decide whether this is an intentional shared demo key vs a secret that must not be bundled, and document the choice.

Decision options

1. Shared public/demo key with rate-limit expectations (document abuse risk)
2. Per-user / env-provided key (no key in resources)
3. Proxy that keeps the key server-side (out of scope unless chosen)

Acceptance

• Written decision in SECURITY or GIF feature docs
• Packaging matches that decision