refactor(vault-pinning): use the broker and remove NEXT_PUBLIC provider credentials #46

Summary

Point the Pinata and Lighthouse adapters at the broker routes and delete the browser-side credentials.

Estimated size: S

Motivation

Finishes the credential-safety work started by the broker.

Current state in this repo

• NEXT_PUBLIC_PINATA_JWT and NEXT_PUBLIC_LIGHTHOUSE_KEY are read in services/*.ts; frontend/tests/vault-pinning.test.mjs sets NEXT_PUBLIC_LIGHTHOUSE_KEY.

Proposal

• Adapters call the broker routes through fetch.
• Remove the NEXT_PUBLIC_* reads, update tests and docs.
• Add a short upgrade note: any provider key that was ever exposed as NEXT_PUBLIC_* should be rotated.

Acceptance criteria

• git grep NEXT_PUBLIC_PINATA NEXT_PUBLIC_LIGHTHOUSE returns nothing.
• The production build output contains no provider credential.
• Existing vault-pinning tests pass against the broker.

Dependencies

• feat(vault): server-side pinning broker routes #45

Testing plan

• Update frontend/tests/vault-pinning.test.mjs; add a build-output check for the credential strings.

Part of #43. Ground rules for the content layer: no secrets in the repo, content-layer failures must never block or discard quantum execution, and tests and docs ship with every PR.