feat(web): add Cloudflare Turnstile to the public forms

Render the widget on the contact, event registration and both application
forms, and verify the token with Siteverify in each action before anything
is written to the CMS. Verification fails closed. The check is off unless
both TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY are set.

Allow challenges.cloudflare.com in script-src and frame-src.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/web/.env.example

@@ -45,3 +45,15 @@ STRAPI_URL=http://localhost:1337
 # Optional Strapi API token. Only needed to read draft or otherwise protected
 # content; published content is public. Settings -> API Tokens in the admin.
 STRAPI_TOKEN=
+
+# --- Bot protection --------------------------------------------------------
+
+# Cloudflare Turnstile on the public forms (contact, event registration and
+# both application forms). Both keys or neither: with either one empty, no
+# widget renders and submissions are not checked. The site key is public and
+# reaches the browser; the secret key never does.
+# Cloudflare dashboard -> Turnstile -> your widget. For local testing,
+# Cloudflare's always-pass pair is 1x00000000000000000000AA (site) and
+# 1x0000000000000000000000000000000AA (secret).
+TURNSTILE_SITE_KEY=
+TURNSTILE_SECRET_KEY=