fix(arcrun): address PR #2 review findings

Security:
- init.ts: remove cf_api_token from POST /register (only email sent to arcrun.dev)
- cf-api.ts: remove base64 fallback in encryptCredential, throw clear error if key missing

Correctness:
- submitComponent.ts: replace KBDB dependency with SUBMISSIONS_KV + R2 (standalone)
- registry/types.ts: remove KBDB_URL/KBDB_INTERNAL_TOKEN, add SUBMISSIONS_KV/ANALYTICS_KV
- webhooks.ts: add waitUntil(writeExecutionVerdict) for fire-and-forget analytics
- execution-logger.ts: create missing module (was imported but didn't exist)
- cypher-executor/types.ts + wrangler.toml: add ANALYTICS_KV binding
- gmail/telegram/google_sheets/line_notify/http_request: no_network_syscall false (api category)
- init.ts: replace require() with await import() for ES module compatibility

Cleanup:
- Remove arcrun/builtins/ (dead code — initComponents used old HTTP endpoint model,
  all 21 components now in TinyGo WASM under registry/components/)

Docs:
- tasks.md: update to reflect completed work and remaining items

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

builtins/src/actions/initComponents.ts

@@ -1,43 +0,0 @@
-// initComponents：把所有內建零件上架到 Component Registry（via Service Binding）
-import type { Bindings } from '../types';
-import { buildComponentDefs } from '../types';
-
-async function publishOne(
-  registry: Fetcher,
-  def: ReturnType<typeof buildComponentDefs>[number],
-): Promise<{ id: string; status: number; ok: boolean; error?: unknown }> {
-  const payload = {
-    id: def.id,
-    name: def.name,
-    description: def.description,
-    url: def.url,
-    method: def.method,
-    tags: def.tags,
-    input_schema: JSON.stringify(def.input_schema),
-    output_schema: JSON.stringify(def.output_schema),
-    author: 'u6u-builtins',
-    version: '1.0.0',
-  };
-
-  const res = await registry.fetch('http://registry/components', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(payload),
-  });
-
-  const body = await res.json().catch(() => ({ error: 'parse error' }));
-  // 201 = 新建成功；409 = 已存在（也算 ok）
-  const isOk = res.status === 201 || res.status === 409 || res.ok;
-  return { id: def.id, status: res.status, ok: isOk, ...(!isOk && { error: body }) };
-}
-
-export async function initComponents(
-  env: Bindings,
-): Promise<{ ok: number; failed: number; results: unknown[] }> {
-  const defs = buildComponentDefs(env.WORKER_BASE_URL);
-  const results = await Promise.all(defs.map(def => publishOne(env.REGISTRY, def)));
-
-  const ok = results.filter(r => r.ok).length;
-  const failed = results.filter(r => !r.ok).length;
-  return { ok, failed, results };
-}