feat(contact): add Cloudflare Turnstile captcha

Client renders explicit Turnstile widget (flexible, light theme) when
PUBLIC_TURNSTILE_SITE_KEY is set. Token sent with form payload, server
verifies via siteverify endpoint before forwarding to CMS. Skipped
entirely when no site key configured (dev fallback). New i18n keys:
contact_captcha_pending, contact_server_error_captcha. Deploy workflow
forwards PUBLIC_TURNSTILE_SITE_KEY + TURNSTILE_SECRET.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/translations.ts

@@ -314,6 +314,8 @@ const TRANSLATION_KEYS = [
   "contact_error_message_too_many_links", // {{n}}
   "contact_error_message_invalid_chars",
   "contact_error_consent_required",
+  "contact_captcha_pending",
+  "contact_server_error_captcha",
 ] as const;
 
 export type TranslationKey = (typeof TRANSLATION_KEYS)[number];