Reapply "Add Turnstile captcha to login"

This reverts commit a7c732e139.

.env.example

@@ -20,6 +20,13 @@ ADMIN_EMAIL=admin@admin.com
 ADMIN_PASSWORD=admin123
 JWT_SECRET=super_secret_jwt_key_123
 
+# --- CAPTCHA / Bot Protection (Optional) ---
+# Create keys in Cloudflare Turnstile and set both values in production.
+# When TURNSTILE_SECRET_KEY is empty, backend CAPTCHA enforcement is disabled.
+TURNSTILE_SECRET_KEY=
+
 # --- Frontend Configuration (Optional) ---
 # If you need to override the API URL for the frontend
 # VITE_API_URL=/api
+# Cloudflare Turnstile site key shown on the login page
+VITE_TURNSTILE_SITE_KEY=