chore(security): wire Cloudflare Turnstile captcha for wall + comments

[drkostas]

The community-wall and blog-comments POST handlers already include a Turnstile verification step that fails open when `TURNSTILE_SECRET_KEY` is unset. This is fine for the current traffic level but means there's no real bot wall today.

What to do

1. Create a free Turnstile site key + secret key on Cloudflare (no charge; tied to the Cloudflare account).
2. Push `TURNSTILE_SECRET_KEY` to Vercel env (production).
3. Push `PUBLIC_TURNSTILE_SITE_KEY` to Vercel env too (it's safe to expose — the secret key is the one that matters).
4. Add the `<div class="cf-turnstile" data-sitekey="...">` widget to the wall + comments forms.
5. Submit the captcha token in the POST body as `turnstile`.
6. Verify the existing fall-open logic in `src/pages/api/wall/messages.ts` still works when key is missing (so dev still works without setup).

Why P3

No actual bot traffic observed yet. Worth doing before that becomes a problem.