feat(web): add Cloudflare Turnstile to the public forms

Render the widget on the contact, event registration and both application
forms, and verify the token with Siteverify in each action before anything
is written to the CMS. Verification fails closed. The check is off unless
both TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY are set.

Allow challenges.cloudflare.com in script-src and frame-src.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

This commit is contained in:

Illusion

2026-10-24 12:05:51 +02:00

co-authored by

Claude Opus 5.5

parent 0b2c8d581f

commit 709a978da5

17 changed files with 475 additions and 15 deletions

									
										apps/web/app/components/ui/Turnstile/index.ts
									
		+2
		
												View File
												
				@@ -0,0 +1,2 @@

				export { Turnstile, default } from "./Turnstile";

				export type { TurnstileAction, TurnstileProps } from "./Turnstile";