feat(web): add Cloudflare Turnstile to the public forms

Render the widget on the contact, event registration and both application
forms, and verify the token with Siteverify in each action before anything
is written to the CMS. Verification fails closed. The check is off unless
both TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY are set.

Allow challenges.cloudflare.com in script-src and frame-src.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/web/app/i18n/messages/ar.json

@@ -168,6 +168,8 @@
     "errorEmail": "أدخل بريدًا إلكترونيًا صالحًا.",
     "errorConsent": "يرجى تأكيد الموافقة لإتمام التسجيل.",
     "errorGeneric": "حدث خطأ ما. يرجى المحاولة مرة أخرى.",
+    "errorVerification": "تعذّر إكمال التحقق الأمني. يرجى المحاولة مرة أخرى.",
+    "verificationUnavailable": "تعذّر تحميل التحقق الأمني. يرجى التأكد من تفعيل JavaScript ثم إعادة تحميل الصفحة.",
     "successTitle": "شكرًا لك",
     "successBody": "تم إرسال رسالتك. سنعاود التواصل معك في أقرب وقت ممكن."
   },

apps/web/app/i18n/messages/en.json

@@ -168,6 +168,8 @@
     "errorEmail": "Enter a valid email address.",
     "errorConsent": "Please confirm this to complete your registration.",
     "errorGeneric": "Something went wrong. Please try again.",
+    "errorVerification": "The security check could not be completed. Please try again.",
+    "verificationUnavailable": "The security check could not load. Please make sure JavaScript is enabled, then reload the page.",
     "successTitle": "Thank you",
     "successBody": "Your message has been sent. We will get back to you as soon as we can."
   },