Add Cloudflare Turnstile verification middleware

[HTMHell]

Summary

• Add FastAPI HTTP middleware that verifies Cloudflare Turnstile tokens on all endpoints except /health
• Reads cf-turnstile-response header, validates against Cloudflare siteverify API using TURNSTILE_SECRET_KEY env var
• Returns 403 for missing or invalid tokens

Test plan

• Set TURNSTILE_SECRET_KEY env var and verify requests without token return 403
• Verify requests with valid Turnstile token return 200
• Verify /health endpoint remains accessible without token

🤖 Generated with Claude Code

[HTMHell]

Switching to GCP Cloud Armor + reCAPTCHA Enterprise approach instead of app-level Turnstile middleware