Move turnstile check to api (#3845)

## Description

Re-enables Turnstile verification (was temporarily disabled in v31 to
diagnose intermittent `invalid-input-response` rejections) and moves the
verification call off the game servers.

Game servers no longer hold `TURNSTILE_SECRET_KEY` or hit
`challenges.cloudflare.com` directly. Instead they POST to
`${jwtIssuer}/turnstile` on the api-worker (authenticated with the
existing `apiKey`), which holds the secret and proxies to Cloudflare.
Shrinks blast radius and removes the secret from every game host + GH
Actions workflow.

Response from the api-worker is Zod-validated; null tokens short-circuit
to `rejected` locally.

## Please complete the following:

- [x] I have added screenshots for all UI updates (n/a — server only)
- [x] I process any text displayed to the user through translateText()
(n/a — no user-visible text)
- [ ] I have added relevant tests to the test directory
- [x] I confirm I have thoroughly tested these changes and take full
responsibility for any bugs introduced

## Discord:

evanpelle

src/core/configuration/Config.ts

@@ -25,7 +25,6 @@ export enum GameEnv {
 
 export interface ServerConfig {
   turnstileSiteKey(): string;
-  turnstileSecretKey(): string;
   turnIntervalMs(): number;
   gameCreationRate(): number;
   numWorkers(): number;

src/core/configuration/DefaultConfig.ts

@@ -43,9 +43,6 @@ const JwksSchema = z.object({
 });
 
 export abstract class DefaultServerConfig implements ServerConfig {
-  turnstileSecretKey(): string {
-    return Env.TURNSTILE_SECRET_KEY ?? "";
-  }
   abstract turnstileSiteKey(): string;
   allowedFlares(): string[] | undefined {
     return;

src/core/configuration/DevConfig.ts

@@ -8,10 +8,6 @@ export class DevServerConfig extends DefaultServerConfig {
     return "1x00000000000000000000AA";
   }
 
-  turnstileSecretKey(): string {
-    return "1x0000000000000000000000000000000AA";
-  }
-
   adminToken(): string {
     return "WARNING_DEV_ADMIN_KEY_DO_NOT_USE_IN_PRODUCTION";
   }

src/core/configuration/Env.ts

@@ -62,9 +62,6 @@ export const Env = {
     return getEnv("GAME_ENV") ?? "dev";
   },
 
-  get TURNSTILE_SECRET_KEY() {
-    return getEnv("TURNSTILE_SECRET_KEY");
-  },
   get STRIPE_PUBLISHABLE_KEY() {
     return getEnv("STRIPE_PUBLISHABLE_KEY");
   },