refactor(share): remove GALLERY_SECRET, use plaintext + SHA-256 integrity for .infiplot files

The encrypted .infiplot format (AES-256-GCM via GALLERY_SECRET) provided no
meaningful security — the payload is AI-generated story content with no
credentials or PII, and the project is open source. Replace with plaintext +
SHA-256 integrity check (format v2). Story share is now always enabled without
requiring a server secret.

- galleryCrypto.ts: AES-256-GCM → plaintext + SHA-256 hash; remove secret param
- 4 API routes: remove GALLERY_SECRET guard and 503 fallback
- story-unpack: forward specific error messages (v1 compat, hash mismatch)
- gallery/page.tsx: remove stale AES-GCM comment
- AGENTS.md: document gallery-pack/gallery-unpack routes
- .env.example, wrangler.jsonc: remove GALLERY_SECRET references

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/api/story-pack/route.ts

@@ -5,14 +5,6 @@ export const runtime = "nodejs";
 const MAX_DOC_BYTES = 12_000_000;
 
 export async function POST(req: Request): Promise<Response> {
-  const secret = process.env.GALLERY_SECRET;
-  if (!secret) {
-    return Response.json(
-      { error: "剧情分享未启用 (GALLERY_SECRET 未配置)" },
-      { status: 503 },
-    );
-  }
-
   const contentLength = req.headers.get("content-length");
   if (contentLength && Number(contentLength) > MAX_DOC_BYTES + 1024) {
     return Response.json(
@@ -39,7 +31,7 @@ export async function POST(req: Request): Promise<Response> {
     );
   }
 
-  const bytes = await packDoc(docStr, secret);
+  const bytes = await packDoc(docStr);
   const ab = new ArrayBuffer(bytes.byteLength);
   new Uint8Array(ab).set(bytes);
   return new Response(ab, {