tripit: REEL_PROVIDER=anonymous — actually fetch reels (was fake canned caption)

REEL_PROVIDER was unset, so the reel pipeline used FakeReelExtractor, which returns
a CANNED caption — every pasted (tripit #120) or forwarded reel produced a DUMMY
Saved Place instead of reading the real reel. Set REEL_PROVIDER=anonymous in app_env
(covers the web Deployment + the ingest CronJob) so AnonymousReelExtractor does the
real anonymous read. Verified live from the cluster: yt-dlp fetched a real IG /p/
caption (no IG_GRAPHQL_DOC_ID needed — the internal-API path is an optional
optimisation; yt-dlp fallback works). LLM extraction + Nominatim POI geocoding were
already real (prior commits); this was the last fake link in the chain.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/tripit/main.tf

@@ -81,6 +81,12 @@ locals {
     LLM_ENDPOINT        = "http://llama-swap.llama-cpp.svc.cluster.local:8080"
     # Reel-route POI geocoding (ADR-0031/0033) for the in-app paste path too.
     REEL_GEOCODER_PROVIDER = "nominatim"
+    # The REEL FETCHER (ADR-0031): anonymous IG/TikTok read via yt-dlp (the IG
+    # internal-API path is an optional optimisation gated on IG_GRAPHQL_DOC_ID;
+    # unset = yt-dlp only, which works). Was UNSET -> FakeReelExtractor returned a
+    # CANNED caption, so every pasted/forwarded reel produced a DUMMY place.
+    # Verified: yt-dlp reads a real IG /p/ caption from the cluster, no doc_id.
+    REEL_PROVIDER = "anonymous"
     MAIL_INGEST_ENABLED = "false"
     # Outbound mail (native-auth signup-verification + account recovery, linked-
     # email verification, trip-share invites) — submitted via the cluster