feat: add Cloudflare Turnstile protection - #27

Summary

• add optional Cloudflare Turnstile validation for comments and replies
• validate the expected action and optional allowed hostnames on the Worker
• expose the configured site key to the widget and render Turnstile inside its Shadow DOM
• preserve solved challenges across previews, form state updates, pre-verification rate-limit responses, and comment likes
• document the backend and frontend configuration

Motivation

CWD currently accepts public comment submissions without a challenge. This adds an opt-in, server-verified Turnstile layer while keeping existing installations unchanged when no secret key is configured.

Configuration

Set TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY. TURNSTILE_ALLOWED_HOSTNAMES can optionally restrict accepted token hostnames.

Validation

• pnpm vitest run src/utils/turnstile.spec.ts src/api/public/postComment.spec.ts
• node --test src/components/turnstile-lifecycle.test.js src/core/api.test.js src/utils/emotions.test.js
• npm run build in docs/widget