LLM: keep API key in localStorage only, default to muse-spark-1.3

Secrets must never be baked into the static build. Stop reading
VITE_AI_API_KEY from env — key comes only from localStorage via the
⚙️ config dialog (flow-state:llm). Gateway URL / model may still come
from env as non-secret defaults.

- src/llm/config.js: DEFAULTS model → meta/muse-spark-1.3-contributor
  (cheap, per user request), readEnv no longer touches apiKey,
  getLlmConfig resolves key only from stored.apiKey.
- .env.example: drop VITE_AI_API_KEY=, document browser-only key flow.
- src/main.js: dialog copy now says key is browser-only, never baked.

Build + lint:scenes + tests still green. No VITE_AI_API_KEY string
remains in source.

Co-Authored-By: Claude <noreply@anthropic.com>

flow-state/.env.example

@@ -1,5 +1,5 @@
-# Vercel AI Gateway — copy to .env.local and fill VITE_AI_API_KEY
-# Get a token at https://vercel.com/dashboard/ai-gateway
+# Vercel AI Gateway (non-secret defaults). The API key is NOT set here —
+# it lives only in the browser's localStorage, entered via the ⚙️ dialog.
+# Copy to .env.local to override defaults for gateway / model if needed.
 VITE_AI_GATEWAY_URL=https://ai-gateway.vercel.sh/v1
-VITE_AI_MODEL=openai/gpt-4o-mini
-VITE_AI_API_KEY=
+VITE_AI_MODEL=meta/muse-spark-1.3-contributor