Unified CAPTCHA verification — Turnstile, reCAPTCHA, and hCaptcha. Provider selection via settings, optional decryption hook for secrets at rest, fail-open when 'none' is configured, fail-closed on misconfiguration. Zero dependencies.