feat(chat): GIF picker via server-proxied GIPHY (#5) (batch87)

- Server: GET /api/gifs proxies GIPHY search/trending. The API key is read from the server
  env only (config.GIPHY_API_KEY, from the gitignored .env) and NEVER reaches the browser;
  the picker is hidden when it isn't configured.
- Emoji picker gains a GIF tab (separated from the emoji categories) with a search box + a 2-col
  grid, "Powered by GIPHY" attribution. Clicking a GIF sends it immediately.
- GIFs are HOTLINKED to GIPHY's CDN (their terms require this — no re-hosting): the message body
  is the GIF url, and a body that is a lone GIF url renders inline as the animated GIF (reusing
  the image/lightbox path). Sidebar previews + notifications show "🎞️ GIF", not the raw url.

Key is NOT in git — set as GIPHY_API_KEY in the server .env.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/config.js

@@ -38,6 +38,10 @@ const SMTP_FROM = process.env.SMTP_FROM || (SMTP_USER ? ('Biz Connect <' + SMTP_
 const SMTP_ENABLED = !!(SMTP_HOST && SMTP_USER && SMTP_PASS);
 const PUBLIC_BASE_URL = (process.env.PUBLIC_BASE_URL || 'https://remote.bizgaze.com').replace(/\/+$/, '');
 
+// GIPHY GIF search (#5). Key is read from the server env only and never sent to the browser — the client
+// calls our /api/gifs proxy. GIF picker is hidden when this isn't configured.
+const GIPHY_API_KEY = process.env.GIPHY_API_KEY || '';
+
 module.exports = {
   PORT: process.env.PORT || 8090,
   HTTPS_PORT: process.env.HTTPS_PORT || 8443,
@@ -53,6 +57,7 @@ module.exports = {
   SMTP_FROM,
   SMTP_ENABLED,
   PUBLIC_BASE_URL,
+  GIPHY_API_KEY,
   PUBLIC_DIR,
   REC_DIR,
   TRANS_DIR,