feat: opt-in Cloudflare Turnstile on login and register (golem15.user.turnstile)

- empty (default) adds nothing; open or closed appends turnstile:{mode} to
  POST /login and /register only; any other value fails boot naming the key
- TestTurnstileRoutesSmoke records the declared routes with a recording router

config/config.yaml

@@ -24,3 +24,8 @@ api_tokens:
   prefix: usr_
 privileged_groups:
   - admin
+# Cloudflare Turnstile on POST /login and /register. Empty (the default) adds
+# nothing. "open" lets requests pass when Cloudflare is unreachable, "closed"
+# refuses them. The turnstile:* middleware comes from the framework (summercms
+# v0.3.0 and later); its secret is turnstile.secret (SUMMER_TURNSTILE__SECRET).
+turnstile: ""