Signup verifies a Turnstile token on the server before it makes an account, through a verifyHuman option on createApp #1695

Replaces #1665 (the owner's ask from #661), unchanged in scope.

Done looks like:

• [ ] A verifier posts the token and secret to Cloudflare's siteverify; createApp takes verifyHuman so tests inject a fake and touch no network.
• [ ] With a secret configured (environment, never the repository), signup refuses a missing or bad token with a plain sentence before it hashes a password or makes an account; with none, signup is as today.
• [ ] test/turnstile.test.ts: off → works; good token → account; no or bad token → refused, no account row.

Start from today's main (0.7.107 or later). Before pushing run bun x tsc --noEmit, the test files this touches and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit. Earlier tries went red because their branch was cut before main changed the home and asks tests: if the check is red on a test this pull does not touch, merge origin/main, run that test here, and push again; if it is still red, name it in the pull.