Story Share portal: anonymous public story submission

Context

The Story Share portal (/story_shares) now has a signed-in "Share your story" page that reuses the existing StoryIdea flow (see the portal-parity PR). This mirrors the live WordPress site's /share/ form in spirit, but the WP form is fully anonymous — any visitor can submit without an account.

Our StoryIdea model can't be anonymous today: it requires a created_by User and an organization_id drawn from the submitter's own organizations.

What's needed for anonymous submission

• Add submitter identity columns to story_ideas (e.g. submitter_name, submitter_email, free-text submitter_organization) so a story can be attributed without a User/Organization record.
• Attribute anonymous submissions to a system/sentinel user (or make created_by optional with a guard).
• Relax StoryIdeaPolicy#new?/create? to allow guests for the portal route only (keep the admin index/show gated).
• Spam protection (reCAPTCHA/hCaptcha or honeypot + rate limiting) — the WP form is reCAPTCHA-gated.
• Consent checkbox matching the WP form's permission language.
• Moderation: anonymous submissions land in the existing admin review queue; titles are editorial (the WP form has no title field).

Parity notes (from stories.awbw.org research)

• WP /share/ fields: first/last name, name-display preference (full / first-only / hide), email (not published), organization (free text), state (free text), workshop name, featured image/video, YouTube URL, story body, additional images, category checkboxes (sectors), audience checkboxes, consent checkbox. No title.
• WP's anonymity is a real privacy bug (full name is in the HTML, hidden with CSS; email is exposed via the open REST API). Our version must handle credit server-side via AuthorCreditable and never render or expose hidden identity.

Out of scope

Signed-in submission already ships in the portal-parity work; this issue covers only the anonymous path.

Start at the /story_shares portal route and inspect StoryIdea, StoryIdeaPolicy, the story_ideas schema, and AuthorCreditable; compare the listed fields with the WordPress /share/ form and its privacy notes. Map the anonymous identity, guest authorization, spam protection, consent, and moderation requirements, with completion requiring the anonymous path to preserve privacy and reach the existing admin review queue.