Free tier: drop spurious BYO key gate; clarify bundled vs BYO

The previous free-tier commit (c0975fe) blocked USE_SERVER_KEY for
unlicensed users on the theory that this protected a "bundled key."
That conflated two different things:

  • USE_SERVER_KEY = the user's OWN Gemini key, just stored server-side
    via the StartOS configuration action (vs. browser localStorage).
    Both paths are BYO — the user pays Google directly either way.

  • Bundled key = a future relay where paid users' /api/process requests
    are proxied through the operator's service and the operator absorbs
    the API cost. Sketched in UPGRADE-DESIGN.md (deleted, in git history)
    but NOT YET BUILT.

Blocking USE_SERVER_KEY broke a legitimate flow: a free user installs
the app on their own StartOS, sets their Gemini key via the config
action, then summarizes from the web UI without re-entering it.

This commit:
  • Drops the BYO/USE_SERVER_KEY rejection in /api/process. Free users
    can use a key from either path; the existing `if (!apiKey)` check
    still catches the no-key-anywhere case with a helpful message.
  • Reverts the frontend submit-button and handleSubmit checks to the
    same key requirement for both tiers (state.apiKey OR state.hasServerKey).
  • Drops "bundled API key" from the activation-screen subtitle and
    "bring your own Gemini key" from the free-mode banner. Until the
    relay is built, paid users still BYO too — promising otherwise in
    upgrade copy is misleading.
  • Keeps the parts that ARE legitimate free-vs-paid differentiators:
    the one-at-a-time concurrency lock and skipping saveToHistory.

Also fixes the `make deploy` redundancy:
  • bin/bump-version.sh accepts --from-deploy. When set, if there is no
    .release-notes-pending.txt (consumed by a prior bump or never
    written), exit 0 without prompting — the current version is already
    fresh.
  • Makefile passes --from-deploy from the deploy target. Standalone
    `make bump` is unchanged (always prompts).

Result: `make bump` then `make deploy` no longer double-prompts. And
calling `make deploy` twice in a row (no new work) is idempotent on
the bump step.

bin/bump-version.sh

@@ -12,16 +12,40 @@
 # This is the convention Claude uses after making code changes. The file is
 # deleted on a successful bump.
 #
+# Flags:
+#   --from-deploy   Treat the absence of .release-notes-pending.txt as the
+#                   signal that no new work needs to ship — exit 0 without
+#                   bumping. Lets `make deploy` always include this step
+#                   without forcing a redundant bump when the user (or a
+#                   prior run) already bumped.
+#
 # Run standalone with `make bump`, or as the first step of `make deploy`.
 
 set -euo pipefail
 
+FROM_DEPLOY=0
+for arg in "$@"; do
+  case "$arg" in
+    --from-deploy) FROM_DEPLOY=1 ;;
+  esac
+done
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 VERSIONS_DIR="$PROJECT_ROOT/startos/versions"
 INDEX_FILE="$VERSIONS_DIR/index.ts"
 PENDING_NOTES_FILE="$PROJECT_ROOT/.release-notes-pending.txt"
 
+# When invoked from `make deploy`, treat a missing pending-notes file as
+# "nothing new to ship — current version is already fresh, skip the bump."
+# Standalone `make bump` always prompts.
+if [ "$FROM_DEPLOY" = "1" ] && [ ! -f "$PENDING_NOTES_FILE" ]; then
+  echo ""
+  echo "  (No .release-notes-pending.txt — current version is already bumped. Skipping.)"
+  echo ""
+  exit 0
+fi
+
 # --- Discover current version ---
 CURRENT_VAR="$(sed -nE "s/.*current:[[:space:]]*(v_[0-9_]+).*/\1/p" "$INDEX_FILE" | head -1)"
 if [ -z "$CURRENT_VAR" ]; then