feat(web): add Cloudflare Turnstile to the public forms

Render the widget on the contact, event registration and both application
forms, and verify the token with Siteverify in each action before anything
is written to the CMS. Verification fails closed. The check is off unless
both TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY are set.

Allow challenges.cloudflare.com in script-src and frame-src.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/web/app/routes/_events-opportunities/forms.ts

@@ -7,7 +7,8 @@
 
    Both forms work without JavaScript: they are plain <Form method="post">
    submissions, so validation has to be complete on the server. There is no
-   client mirror of these rules to drift out of sync.
+   client mirror of these rules to drift out of sync. (The Cloudflare
+   Turnstile check, when configured, is the one part that needs scripting.)
    ========================================================================= */
 
 import type { TranslationKey } from "~/i18n";