Replace the broken R2-backed LFS URL with lfs.openpencil.dev and keep storage credentials behind the gateway. Fixes #457.