feat: remove HTTP Basic Auth from Kit stack services

Removed authentication middleware from Vert and Paint services:
- Removed basicauth middleware labels from vert service
- Removed basicauth middleware labels from paint service
- Updated middleware chains to exclude auth
- Updated CLAUDE.md to reflect public access

All Kit stack services (landing, vert, paint) are now publicly
accessible without authentication as they are client-side tools
that don't require protection.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

CLAUDE.md

@@ -269,13 +269,12 @@ VERT universal file format converter:
 - No file size limits
 - Privacy-focused: all conversions happen in the browser
 - No persistent data storage required
-- Protected by HTTP Basic Auth (credentials in `.env`)
+- Publicly accessible (no authentication required)
 
 **Configuration**:
 - **PUB_HOSTNAME**: `vert.kit.pivoine.art` (public hostname)
 - **PUB_ENV**: `production` (environment mode)
 - **PUB_DISABLE_ALL_EXTERNAL_REQUESTS**: `true` (privacy mode)
-- **AUTH_USERS**: Shared HTTP Basic Auth credentials (htpasswd format in `.env`)
 
 **Usage**:
 Access https://vert.kit.pivoine.art and drag/drop files to convert between formats. All processing happens in your browser using WebAssembly - no data is uploaded to the server.