Stock image search is now offered only to authenticated users, matching what the
server already enforces (the /api/stock/* routes 401 anonymous callers). Previously the
toolbar's "Stock photo" button used the relaxed requireAuth gate, which passes through in
the local-first scaffold where stock can't actually work (no Supabase Storage/account).
app/page.tsx: new requireUser gate — a real signed-in user opens the picker; a
signed-out visitor gets the sign-in prompt. The "Stock photo" tool is hidden entirely
when there's no auth backend (showStock={auth.configured}).
components/Toolbar.tsx: drops the stock item from the Media group when showStock is false.
lib/ai/board.ts: ACTIONS_SPEC is now buildActionsSpec({ stock }); the AI's
create_stock_image action is advertised only when the caller is authenticated
(app/api/ai/route.ts passes stock: !!userId), so anonymous/local AI sessions don't
get a stock action that would just 401.
