Security: remove client-side UploadThing credentials

[bobtista]

Summary

Remove the legacy UploadThing credential flow from the desktop client. This path affected development artifacts and was not present in the last public release.

Scope

• Remove CI credential injection and client decoding.
• Disable upload and delete operations while preserving public-link imports.
• Make history removal local-only.
• Add tests and update developer documentation.

Follow-up

Rotate the credential, remove obsolete repository secrets, and privately review account activity. Future uploads require short-lived server-issued authorization or signed URLs.

Related: #233, #238

[coderabbitai]

Warning

Could not create a plan because the ticket is lacking information or is ambiguous.

You can reply directly to this comment with additional context or clarifications to help CodeRabbit complete the planning task, with an @-mention to the bot.