Add full-screen API-key gate

In user-key mode a browser with no stored Ollama key now gets a polished
gate instead of the app shell: one masked input with a show/hide toggle,
a single Continue button, inline validation errors, and a "?" help sheet
with the steps to a free key.

- Validates the draft key through /api/health (real 1-token probe) before
  saving; invalid-key and network failures read differently.
- Key still lives only in this browser's localStorage; nothing server-side.
- Gate wraps /, /create and deck study; server-key and local-daemon modes
  skip it; removing the key in Settings brings it back.
- Removes the now-redundant dashboard/create API-key banner.
- Monochrome corner glows (dark near-black / light near-white), 24px card,
  48px field and button, gentle fade/slide-in, reduced-motion aware.
- Help modal: centred dialog on desktop, bottom sheet on mobile, closes via
  X, Escape or backdrop.
- README and browser suites updated (34 gate checks, 15 key-flow checks,
  12 shipped-default checks; ui/folders/docs/pwa/security/contrast green).

lib/settings.ts

@@ -11,6 +11,9 @@
 
 const STORAGE_KEY = "freezmo.settings.v1";
 
+/** Header that carries the browser's key to Freezmo's own API routes. */
+export const API_KEY_HEADER = "x-ollama-key";
+
 export type BrowserSettings = {
   /**
    * The user's own Ollama API key. Nothing else is stored here — the endpoint
@@ -80,5 +83,5 @@ export function clearApiKey(): void {
 /** Header used to hand the key to our own API routes for one request. */
 export function authHeaders(): Record<string, string> {
   const { apiKey } = settingsStore.getSnapshot();
-  return apiKey ? { "x-ollama-key": apiKey } : {};
+  return apiKey ? { [API_KEY_HEADER]: apiKey } : {};
 }