Free tier: drop spurious BYO key gate; clarify bundled vs BYO

The previous free-tier commit (c0975fe) blocked USE_SERVER_KEY for
unlicensed users on the theory that this protected a "bundled key."
That conflated two different things:

  • USE_SERVER_KEY = the user's OWN Gemini key, just stored server-side
    via the StartOS configuration action (vs. browser localStorage).
    Both paths are BYO — the user pays Google directly either way.

  • Bundled key = a future relay where paid users' /api/process requests
    are proxied through the operator's service and the operator absorbs
    the API cost. Sketched in UPGRADE-DESIGN.md (deleted, in git history)
    but NOT YET BUILT.

Blocking USE_SERVER_KEY broke a legitimate flow: a free user installs
the app on their own StartOS, sets their Gemini key via the config
action, then summarizes from the web UI without re-entering it.

This commit:
  • Drops the BYO/USE_SERVER_KEY rejection in /api/process. Free users
    can use a key from either path; the existing `if (!apiKey)` check
    still catches the no-key-anywhere case with a helpful message.
  • Reverts the frontend submit-button and handleSubmit checks to the
    same key requirement for both tiers (state.apiKey OR state.hasServerKey).
  • Drops "bundled API key" from the activation-screen subtitle and
    "bring your own Gemini key" from the free-mode banner. Until the
    relay is built, paid users still BYO too — promising otherwise in
    upgrade copy is misleading.
  • Keeps the parts that ARE legitimate free-vs-paid differentiators:
    the one-at-a-time concurrency lock and skipping saveToHistory.

Also fixes the `make deploy` redundancy:
  • bin/bump-version.sh accepts --from-deploy. When set, if there is no
    .release-notes-pending.txt (consumed by a prior bump or never
    written), exit 0 without prompting — the current version is already
    fresh.
  • Makefile passes --from-deploy from the deploy target. Standalone
    `make bump` is unchanged (always prompts).

Result: `make bump` then `make deploy` no longer double-prompts. And
calling `make deploy` twice in a row (no new work) is idempotent on
the bump step.

server/index.js

@@ -2010,17 +2010,14 @@ app.get("/api/processing/log", (req, res) => {
 app.post("/api/process", async (req, res) => {
   const { url, apiKey: clientKey, model, type: itemType, title: itemTitle, uploadDate: itemUploadDate, episodeId } = req.body;
 
-  // Free tier: unlicensed users can summarize, but only with their own
-  // Gemini key (no riding on the bundled key) and only one job at a time.
+  // Free tier: unlicensed users can summarize one video at a time. They
+  // still bring their own Gemini key — same as paid users today; the key
+  // can come from either the StartOS config action (server-side) or the
+  // web UI Settings panel (client-side). The future "bundled key" relay
+  // (paid users' requests proxied through the operator's service) isn't
+  // built yet, so there's nothing here that gates key sourcing by tier.
   const isFreeUser = !(LIC.state === "licensed" && LIC.entitlements.has("core"));
   if (isFreeUser) {
-    if (!clientKey || clientKey === "USE_SERVER_KEY") {
-      return res.status(402).json({
-        error: "byo_key_required",
-        message:
-          "Free mode requires your own Gemini API key. Open Settings to enter one, or upgrade to use the bundled key.",
-      });
-    }
     if (freeJobInFlight) {
       return res.status(409).json({
         error: "processing_in_progress",