feat: add captcha-backed forum security hardening

app/Services/Security/Captcha/TurnstileCaptchaProvider.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Services\Security\Captcha;
+
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+
+class TurnstileCaptchaProvider implements CaptchaProviderInterface
+{
+    public function name(): string
+    {
+        return 'turnstile';
+    }
+
+    public function isEnabled(): bool
+    {
+        return (bool) config('registration.enable_turnstile', true)
+            && $this->siteKey() !== ''
+            && (string) config('services.turnstile.secret_key', '') !== '';
+    }
+
+    public function siteKey(): string
+    {
+        return (string) config('services.turnstile.site_key', '');
+    }
+
+    public function inputName(): string
+    {
+        return 'cf-turnstile-response';
+    }
+
+    public function scriptUrl(): string
+    {
+        return (string) config('services.turnstile.script_url', 'https://challenges.cloudflare.com/turnstile/v0/api.js');
+    }
+
+    public function verify(string $token, ?string $ip = null): bool
+    {
+        if (! $this->isEnabled()) {
+            return true;
+        }
+
+        if (trim($token) === '') {
+            return false;
+        }
+
+        try {
+            $response = Http::asForm()
+                ->timeout((int) config('services.turnstile.timeout', 5))
+                ->post((string) config('services.turnstile.verify_url', 'https://challenges.cloudflare.com/turnstile/v0/siteverify'), [
+                    'secret' => (string) config('services.turnstile.secret_key', ''),
+                    'response' => $token,
+                    'remoteip' => $ip,
+                ]);
+
+            if ($response->failed()) {
+                return false;
+            }
+
+            return (bool) data_get($response->json(), 'success', false);
+        } catch (\Throwable $exception) {
+            Log::warning('turnstile verification request failed', [
+                'message' => $exception->getMessage(),
+            ]);
+
+            return false;
+        }
+    }
+}