chore(#15): inject Giphy API key via --dart-define (drop hardcoded key)

gif_picker.dart reads GIPHY_API_KEY from String.fromEnvironment instead of a
hardcoded constant - key is supplied at build time (--dart-define-from-file=
dart_defines.json, gitignored), never in source or history. Adds
dart_defines.example.json template + .gitignore entry; picker shows a hint
when no key is configured.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -91,3 +91,6 @@ keystore.properties
 
 # Cloudflare Wrangler
 .wrangler
+
+# Local build secrets (Giphy etc.) — injected via --dart-define-from-file
+dart_defines.json

dart_defines.example.json

@@ -0,0 +1,3 @@
+{
+  "GIPHY_API_KEY": "your-giphy-api-key-from-developers.giphy.com"
+}

lib/widgets/gif_picker.dart

@@ -19,9 +19,11 @@ class _GifPickerState extends State<GifPicker> {
   bool _isLoading = false;
   String? _error;
 
-  // Giphy API key - Using public beta key (limited usage)
+  // Giphy API key — injected at build time, never hardcoded. Provide it via:
-  // For production, replace with your own Giphy API key from developers.giphy.com
+  //   flutter build ... --dart-define-from-file=dart_defines.json
-  static const String _giphyApiKey = 'sXpGFDGZs0Dv1mmNFvYaGUvYwKX0PWIh';
+  // (or --dart-define=GIPHY_API_KEY=<key>). Empty when unset → the picker shows a hint.
+  static const String _giphyApiKey =
+      String.fromEnvironment('GIPHY_API_KEY');
 
   @override
   void initState() {
@@ -36,6 +38,11 @@ class _GifPickerState extends State<GifPicker> {
   }
 
   Future<void> _loadTrendingGifs() async {
+    if (_giphyApiKey.isEmpty) {
+      setState(() => _error =
+          'GIF picker needs a Giphy API key (build with --dart-define=GIPHY_API_KEY=<key>).');
+      return;
+    }
     setState(() {
       _isLoading = true;
       _error = null;