Invisible proof-of-work spam protection: a stateless HMAC challenge the browser solves in ~1s. No puzzle, no third party, no visitor tracking, zero dependencies. A drop-in captcha alternative for any Node app.