Security: remove misleading client-side API key obfuscation

[anupamme]

I've revised this PR to avoid breaking the existing free AI experience.

The original concern remains that the OpenRouter credential is delivered to browser JavaScript and therefore cannot be considered a secret, even though it was obfuscated (Base64 + array-splitting) in the source.

Rather than removing the default AI functionality, this revision:

• keeps the same key and the same Base64-fragment mechanism (mechanically unchanged, since I can't reproduce or verify your actual key value from outside the project);
• renames the previously cryptic _k/_dk identifiers to PUBLIC_AI_KEY_FRAGMENTS/getPublicAIKey;
• documents in-code that this key is intentionally public/recoverable and relies on OpenRouter-side domain/usage restrictions and rate limits (per your comment, these are already in place) rather than on obfuscation;
• adds a regression test asserting that disclosure comment stays in the source and that no separate "DEFAULT_API_KEY" style secret gets introduced;
• keeps the existing AI functionality completely unchanged.

A stronger long-term fix would be to proxy OpenRouter requests through a backend so the credential never reaches the browser at all — but this repo is a static Jekyll site with no server component, so that's a separate, larger architectural change and out of scope here.

This PR is now focused purely on removing the misleading "obfuscation = security" framing, without any functional regression.

[ranxi2001]

I'm a good samaritan. My key is encrypted and can only be used by my project. The project official website provides free AI experience for users. This modification will not be adopted.

我是一个大善人 我的密钥加密过 只有我的项目能够使用 项目官网可以给用户免费提供ai体验 不采纳此修改

[anupamme]

Thanks for the context — makes sense that you want to keep the free AI experience working, and good to know the key is already provider-restricted to your project.

I've pushed a revised commit that no longer touches the key or its Base64-fragment mechanism at all; it only renames the identifiers and adds a code comment stating clearly that this credential is public-by-design (since anything shipped to browser JS is), relying on your OpenRouter-side restrictions rather than obfuscation. A small test now guards that disclosure comment. The default AI experience is unaffected.

Happy to adjust further if any part of this doesn't fit how you'd like it framed.