Free tier: drop spurious BYO key gate; clarify bundled vs BYO

The previous free-tier commit (c0975fe) blocked USE_SERVER_KEY for
unlicensed users on the theory that this protected a "bundled key."
That conflated two different things:

  • USE_SERVER_KEY = the user's OWN Gemini key, just stored server-side
    via the StartOS configuration action (vs. browser localStorage).
    Both paths are BYO — the user pays Google directly either way.

  • Bundled key = a future relay where paid users' /api/process requests
    are proxied through the operator's service and the operator absorbs
    the API cost. Sketched in UPGRADE-DESIGN.md (deleted, in git history)
    but NOT YET BUILT.

Blocking USE_SERVER_KEY broke a legitimate flow: a free user installs
the app on their own StartOS, sets their Gemini key via the config
action, then summarizes from the web UI without re-entering it.

This commit:
  • Drops the BYO/USE_SERVER_KEY rejection in /api/process. Free users
    can use a key from either path; the existing `if (!apiKey)` check
    still catches the no-key-anywhere case with a helpful message.
  • Reverts the frontend submit-button and handleSubmit checks to the
    same key requirement for both tiers (state.apiKey OR state.hasServerKey).
  • Drops "bundled API key" from the activation-screen subtitle and
    "bring your own Gemini key" from the free-mode banner. Until the
    relay is built, paid users still BYO too — promising otherwise in
    upgrade copy is misleading.
  • Keeps the parts that ARE legitimate free-vs-paid differentiators:
    the one-at-a-time concurrency lock and skipping saveToHistory.

Also fixes the `make deploy` redundancy:
  • bin/bump-version.sh accepts --from-deploy. When set, if there is no
    .release-notes-pending.txt (consumed by a prior bump or never
    written), exit 0 without prompting — the current version is already
    fresh.
  • Makefile passes --from-deploy from the deploy target. Standalone
    `make bump` is unchanged (always prompts).

Result: `make bump` then `make deploy` no longer double-prompts. And
calling `make deploy` twice in a row (no new work) is idempotent on
the bump step.

Makefile

@@ -2,13 +2,17 @@
 include s9pk.mk
 
 # ── Deploy ─────────────────────────────────────────────────────────────────
-# `make deploy` — interactively bumps the version, builds the x86 .s9pk,
-# uploads it to FileBrowser, registers with the Start9 registry, and triggers
-# a registry re-index. Reads credentials from .deploy.env — copy
-# .deploy.env.example to .deploy.env and fill in your values.
+# `make deploy` — bump the version (only if .release-notes-pending.txt
+# exists, signalling unshipped changes), build the x86 .s9pk, upload to
+# FileBrowser, register with the Start9 registry, and trigger a re-index.
+# Reads credentials from .deploy.env — copy .deploy.env.example to
+# .deploy.env and fill in your values.
+#
+# The bump step is skipped automatically if you've already run `make bump`
+# (which consumes the pending-notes file). No more double-prompt.
 .PHONY: deploy redeploy bump
 deploy:
-	@bash bin/bump-version.sh
+	@bash bin/bump-version.sh --from-deploy
 	@$(MAKE) --no-print-directory x86
 	@bash bin/deploy.sh