Cloudflare Turnstile en login y registro (Next.js)

- lib/turnstile.ts: verifyTurnstile(token, ip) contra siteverify (fail-closed).
- components/Turnstile.tsx: widget cliente (carga el script de Cloudflare, callback
  con el token). Site key por NEXT_PUBLIC_TURNSTILE_SITE_KEY; secreto server-only.
- LoginForm/RegisterForm: widget + token en el POST; submit deshabilitado hasta
  resolver el captcha (si hay site key).
- Routes login/register: verifican el token antes de continuar (error captchaFailed).
- Catálogos: captchaFailed.

Verificado: POST sin token -> captchaFailed en login y registro (enforcement server).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web-next/app/[locale]/register/RegisterForm.tsx

@@ -2,6 +2,7 @@
 
 import { useState } from 'react'
 import { useTranslations } from 'next-intl'
+import { Turnstile } from '@/components/Turnstile'
 
 const ERROR_KEYS = [
   'missingFields',
@@ -10,13 +11,16 @@ const ERROR_KEYS = [
   'invalidEmail',
   'emailExists',
   'recruiterNotFound',
+  'captchaFailed',
 ] as const
+const SITE_KEY = process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY
 
 export function RegisterForm() {
   const t = useTranslations('Register')
   const [form, setForm] = useState({ password: '', confPassword: '', email: '', confEmail: '', recruiter: '' })
   const [accepted, setAccepted] = useState(false)
   const [busy, setBusy] = useState(false)
+  const [captcha, setCaptcha] = useState('')
   const [message, setMessage] = useState<{ ok: boolean; text: string } | null>(null)
 
   function upd(k: string, v: string) {
@@ -33,7 +37,7 @@ export function RegisterForm() {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         credentials: 'same-origin',
-        body: JSON.stringify(form),
+        body: JSON.stringify({ ...form, turnstileToken: captcha }),
       })
       const data: { success?: boolean; error?: string } = await res.json()
       if (data.success) {
@@ -64,7 +68,8 @@ export function RegisterForm() {
           <input type="checkbox" checked={accepted} onChange={(e) => setAccepted(e.target.checked)} className="mt-1" />
           <span>{t('terms')}</span>
         </label>
-        <button type="submit" disabled={busy || !accepted} className="w-full rounded bg-amber-600 px-4 py-2 font-semibold text-[#1b120b] disabled:opacity-60">
+        <Turnstile onVerify={setCaptcha} />
+        <button type="submit" disabled={busy || !accepted || (!!SITE_KEY && !captcha)} className="w-full rounded bg-amber-600 px-4 py-2 font-semibold text-[#1b120b] disabled:opacity-60">
           {busy ? t('creating') : t('submit')}
         </button>
       </form>