feat: add Cloudflare Turnstile captcha to auth flow

- Add captcha plugin to Better Auth config (cloudflare-turnstile provider)
- Create reusable TurnstileWidget component with script injection
- Integrate Turnstile into login, signup, and forgot-password forms
- Pass x-captcha-response header on protected endpoints
- Add TURNSTILE_SECRET_KEY and NEXT_PUBLIC_TURNSTILE_SITE_KEY to env

lib/auth.ts

@@ -1,5 +1,5 @@
 import { betterAuth } from 'better-auth'
-import { admin, emailOTP, lastLoginMethod } from 'better-auth/plugins'
+import { admin, captcha, emailOTP, lastLoginMethod } from 'better-auth/plugins'
 import { passkey } from '@better-auth/passkey'
 import { expo } from '@better-auth/expo'
 import { drizzleAdapter } from '@better-auth/drizzle-adapter'
@@ -38,6 +38,10 @@ export const auth = betterAuth({
         provider: 'pg'
     }),
     plugins: [
+        captcha({
+            provider: 'cloudflare-turnstile',
+            secretKey: process.env.TURNSTILE_SECRET_KEY!,
+        }),
         emailOTP({
             async sendVerificationOTP({ email, otp, type }) {
                 await sendOTP({ email, otp, type })