feat(auth): Cloudflare Turnstile on /login password form

[implemented.stream (thanabartbb)]

• Widget (explicit render, action password_auth, monochrome, flexible size, TH/EN) in the DevStack account form on /login; fix(auth): Create account button silently did nothing on invalid input #31 client validation kept, plus a captcha-not-ready message.
• /api/auth/password: Siteverify after cheap input checks and before the per-account limiter (no Siteverify calls for malformed posts; bots can't burn a user's per-email budget). Checks success, action and hostname (TURNSTILE_HOSTNAMES=devstack.bid), sends remoteip and an idempotency_key, retries once on network errors with the same key, fails closed. Failure → /login?auth=captcha with a TH/EN notice.
• Off when TURNSTILE_SECRET_KEY is unset (no widget, form works). Cloudflare test secrets skip hostname/action only (they return dummy values).
• CSP: script-src + frame-src https://challenges.cloudflare.com.
• wrangler vars: TURNSTILE_SITE_KEY (public), TURNSTILE_HOSTNAMES. Secret via wrangler secret put. Docs: config-env.md, .dev.vars.example (test keys).
• GitHub/Google/Cursor OAuth unchanged.

Local verification (next start, test keys): pass key → token issued, Siteverify ok, request proceeds; always-fail secret → auth=captcha; no token (curl x2) → auth=captcha without a Siteverify call. No CSP violations. Tests 381 pass. Not merged/deployed.

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit cea3aca:

Sandbox	Source
devstack-my-button	Configuration