refactor(share): remove GALLERY_SECRET, use plaintext + SHA-256 integrity for .infiplot files

The encrypted .infiplot format (AES-256-GCM via GALLERY_SECRET) provided no
meaningful security — the payload is AI-generated story content with no
credentials or PII, and the project is open source. Replace with plaintext +
SHA-256 integrity check (format v2). Story share is now always enabled without
requiring a server secret.

- galleryCrypto.ts: AES-256-GCM → plaintext + SHA-256 hash; remove secret param
- 4 API routes: remove GALLERY_SECRET guard and 503 fallback
- story-unpack: forward specific error messages (v1 compat, hash mismatch)
- gallery/page.tsx: remove stale AES-GCM comment
- AGENTS.md: document gallery-pack/gallery-unpack routes
- .env.example, wrangler.jsonc: remove GALLERY_SECRET references

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/api/gallery-unpack/route.ts

@@ -2,25 +2,9 @@ import { unpackDoc } from "@/lib/galleryCrypto";
 
 export const runtime = "nodejs";
 
-// Cap a bit above pack's MAX_DOC_BYTES — ciphertext adds the 16-byte GCM tag
-// and the 17-byte header; some slack accommodates near-cap docs without
-// rejecting them at unpack time. Bumped to fit pre-baked beat audio.
 const MAX_FILE_BYTES = 13_000_000;
 
-// Decrypt a `.infiplot` share file back to its doc JSON string. Returns the
-// plaintext as a JSON field (not raw bytes) so the client can chain it through
-// JSON.parse without sniffing the response type. Errors are deliberately
-// generic — we don't distinguish "wrong key" from "tampered file" because the
-// distinction would leak server config.
 export async function POST(req: Request): Promise<Response> {
-  const secret = process.env.GALLERY_SECRET;
-  if (!secret) {
-    return Response.json(
-      { error: "图集分享未启用 (GALLERY_SECRET 未配置)" },
-      { status: 503 },
-    );
-  }
-
   let ab: ArrayBuffer;
   try {
     ab = await req.arrayBuffer();
@@ -35,7 +19,7 @@ export async function POST(req: Request): Promise<Response> {
   }
 
   try {
-    const docStr = await unpackDoc(new Uint8Array(ab), secret);
+    const docStr = await unpackDoc(new Uint8Array(ab));
     return Response.json({ docStr });
   } catch (e) {
     return Response.json(