chore(#331): pass GIPHY_API_KEY into artifact builds

Owner added GIPHY_API_KEY as a repo secret, resolving the open decision
flagged on this issue.

The app reads the key at COMPILE time via
String.fromEnvironment('GIPHY_API_KEY') (lib/widgets/gif_picker.dart:25),
so CI builds produced without it ship a non-functional GIF picker that
displays a "needs a Giphy API key" hint. That was harmless while CI
output was discarded; it stopped being harmless in #322 when artifacts
became real deliverables.

Generates dart_defines.json from the secret and passes
--dart-define-from-file, matching how the project is built locally
rather than inventing a second mechanism.

Wired into the four jobs that produce artifacts users run: android,
linux, web, windows. NOT wired into ios and macos, which are compile
checks producing nothing installable, and where the key would have no
effect on whether compilation succeeds.

Uses jq on the Linux runners rather than hand-escaped printf, so the
value is JSON-escaped correctly whatever it contains. An earlier printf
attempt silently mangled an escape and broke the YAML, which is the
argument for using the tool instead of string juggling. jq is verified
preinstalled on the runner images (Ubuntu 22.04 has 1.6, 24.04 has
1.7.1). The windows runner uses PowerShell ConvertTo-Json, since jq is
not guaranteed there.

Note: the key is compiled into the binary and is therefore extractable
from any published APK. Putting it in CI does not widen exposure beyond
what shipping the app already does.

Part of epic #312, plan #321 (Phase 3).

.github/workflows/build.yml

@@ -30,7 +30,11 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-gradle-
       - run: flutter pub get
-      - run: flutter build apk --release --no-pub
+      - name: Write dart_defines.json
+        env:
+          GIPHY_API_KEY: ${{ secrets.GIPHY_API_KEY }}
+        run: jq -n --arg k "$GIPHY_API_KEY" '{GIPHY_API_KEY:$k}' > dart_defines.json
+      - run: flutter build apk --release --no-pub --dart-define-from-file=dart_defines.json
       - name: Upload APK
         uses: actions/upload-artifact@v4
         with:
@@ -61,7 +65,11 @@ jobs:
       - name: Install Linux build deps
         run: sudo apt-get update && sudo apt-get install -y clang cmake ninja-build pkg-config libgtk-3-dev
       - run: flutter pub get
-      - run: flutter build linux --release --no-pub
+      - name: Write dart_defines.json
+        env:
+          GIPHY_API_KEY: ${{ secrets.GIPHY_API_KEY }}
+        run: jq -n --arg k "$GIPHY_API_KEY" '{GIPHY_API_KEY:$k}' > dart_defines.json
+      - run: flutter build linux --release --no-pub --dart-define-from-file=dart_defines.json
       - name: Upload Linux bundle
         uses: actions/upload-artifact@v4
         with:
@@ -90,7 +98,11 @@ jobs:
           flutter-version: "3.44.1"
           cache: true
       - run: flutter pub get
-      - run: flutter build web --release --no-pub
+      - name: Write dart_defines.json
+        env:
+          GIPHY_API_KEY: ${{ secrets.GIPHY_API_KEY }}
+        run: jq -n --arg k "$GIPHY_API_KEY" '{GIPHY_API_KEY:$k}' > dart_defines.json
+      - run: flutter build web --release --no-pub --dart-define-from-file=dart_defines.json
       - name: Upload web build
         uses: actions/upload-artifact@v4
         with:
@@ -108,7 +120,15 @@ jobs:
           flutter-version: "3.44.1"
           cache: true
       - run: flutter pub get
-      - run: flutter build windows --release --no-pub
+      # Windows runner defaults to PowerShell; jq is not guaranteed there,
+      # so build the JSON with ConvertTo-Json, which escapes correctly.
+      - name: Write dart_defines.json
+        env:
+          GIPHY_API_KEY: ${{ secrets.GIPHY_API_KEY }}
+        run: |
+          @{ GIPHY_API_KEY = $env:GIPHY_API_KEY } | ConvertTo-Json -Compress |
+            Set-Content -Path dart_defines.json -Encoding utf8 -NoNewline
+      - run: flutter build windows --release --no-pub --dart-define-from-file=dart_defines.json
       - name: Upload Windows build
         uses: actions/upload-artifact@v4
         with: