Verify Turnstile token

Verifies a Cloudflare Turnstile token against the app's linked widget. Intended to be called from your backend, not the browser — API keys are secrets and must never ship to the client. Both x-app-id and x-app-api-key are required; the server rejects the request with 401 if x-app-id does not match the app embedded in the API key. Create a key via POST /apps/:appId/api-keys (admin JWT required). Returns { success: true } on a valid token or 403 if verification fails. Tokens are single-use (replay-protected).