Configure Cloudflare Turnstile widget for newsletter bot protection

[hasitpbhatt]

We've added Cloudflare Turnstile invisible widget to the newsletter subscribe flow. The code references a placeholder site key that needs to be replaced with your real one.

Steps

1. Go to Cloudflare Dashboard -> Turnstile (https://dash.cloudflare.com/?to=/:account/turnstile)
2. Click "Add a widget"
3. Set widget name to "devcheap newsletter"
4. Set domain to "devcheap.click"
5. Choose "Invisible" widget mode
6. Copy the Site Key and Secret Key

Update the code

1. Replace TURNSTILE_SITE_KEY in js/search.js with your real Site Key
2. Add TURNSTILE_SECRET_KEY as a Cloudflare Pages secret in the Dashboard

Acceptance Criteria

• Turnstile widget created in Cloudflare Dashboard
• Real Site Key set in js/search.js
• TURNSTILE_SECRET_KEY set in Cloudflare Pages secrets
• Newsletter signup works with Turnstile validation in production

Related code: js/search.js (turnstileToken, onTurnstileLoad), functions/api/subscribe.js (Turnstile validation), index.html (Turnstile CSP entries + widget container)