Live-reload Gemini API key config + fix vendor module resolution

Two related changes that ship together because the second was uncovered
while testing the first.

1. Live config reload (the ostensible feature):

   The "Set Gemini API Key" StartOS action writes to /data/config/
   startos-config.json. The server used to read that file once at
   startup (and via a separate Python read in docker_entrypoint.sh
   before that), which meant a key change required a service restart
   to take effect. Now the server polls the file every 3 s
   (RECAP_CONFIG_POLL_MS, env-overridable) and updates serverApiKey
   in place. fs.watch was tried first and dropped — it's flaky on
   macOS (FSEvents single-file quirks) and behaves inconsistently with
   atomic-rename writes the SDK file model uses. Polling is dead
   simple and a stat call every 3 s is free.

   Also dropped the Python config read from docker_entrypoint.sh; the
   server now handles it natively. Entrypoint still loads /data/.env
   for arbitrary env vars (RECAP_*, etc.).

2. Vendor module resolution (the silently-broken thing):

   The earlier vendor change (move @keysat/licensing-client from a
   git+https dep to a file: dep at vendor/) created a symlink in
   server/node_modules. That symlink to the vendor dir was getting
   resolved by Node, so the keysat client tried to import @noble/
   ed25519 from /app/vendor/keysat-licensing-client/dist/, walked up
   to /app/vendor/, then /app/, neither of which had node_modules.

   Result: v0.2.0 and v0.2.1 would crash at startup with
   ERR_MODULE_NOT_FOUND on @noble/ed25519. The Docker BUILD succeeded
   because npm install with file: deps doesn't pull transitive deps
   into the parent node_modules — but the runtime would have failed
   the moment server/license.js ran.

   Fix:
     • Dockerfile builder now `npm install`s inside vendor/keysat-
       licensing-client/ so @noble/* lands in its own node_modules,
       where Node's resolver finds it.
     • Dockerfile runner now COPYs vendor/ to the runner image
       (previously not copied — the symlink in server/node_modules
       would have pointed at nothing).
     • vendor/keysat-licensing-client/package-lock.json is committed
       so the in-Docker install is reproducible.

docker_entrypoint.sh

@@ -22,15 +22,10 @@ fi
 # Point yt-dlp cache to persistent storage (stores OAuth tokens)
 export XDG_CACHE_HOME="$CACHE_DIR"
 
-# Load Gemini API key from StartOS config if available
-if [ -f "$CONFIG_DIR/startos-config.json" ]; then
-  GEMINI_KEY=$(python3 -c "import sys,json; print(json.load(open('$CONFIG_DIR/startos-config.json')).get('gemini_api_key',''))" 2>/dev/null || echo "")
-  if [ -n "$GEMINI_KEY" ]; then
-    export GEMINI_API_KEY="$GEMINI_KEY"
-  fi
-fi
-
-# Also load from .env if it exists in data dir (user override)
+# Load arbitrary env vars from .env if it exists (e.g. RECAP_*).
+# We do NOT read startos-config.json here — the Node server reads that
+# natively at startup AND watches it for live updates, so config changes
+# made via the StartOS action are picked up without a service restart.
 if [ -f "$DATA_DIR/.env" ]; then
   set -a
   . "$DATA_DIR/.env"