Move turnstile check to api (#3845)

## Description

Re-enables Turnstile verification (was temporarily disabled in v31 to
diagnose intermittent `invalid-input-response` rejections) and moves the
verification call off the game servers.

Game servers no longer hold `TURNSTILE_SECRET_KEY` or hit
`challenges.cloudflare.com` directly. Instead they POST to
`${jwtIssuer}/turnstile` on the api-worker (authenticated with the
existing `apiKey`), which holds the secret and proxies to Cloudflare.
Shrinks blast radius and removes the secret from every game host + GH
Actions workflow.

Response from the api-worker is Zod-validated; null tokens short-circuit
to `rejected` locally.

## Please complete the following:

- [x] I have added screenshots for all UI updates (n/a — server only)
- [x] I process any text displayed to the user through translateText()
(n/a — no user-visible text)
- [ ] I have added relevant tests to the test directory
- [x] I confirm I have thoroughly tested these changes and take full
responsibility for any bugs introduced

## Discord:

evanpelle

src/server/Worker.ts

@@ -40,10 +40,6 @@ const workerId = parseInt(process.env.WORKER_ID ?? "0");
 const log = logger.child({ comp: `w_${workerId}` });
 const playlist = new MapPlaylist();
 
-// TEMPORARY: Turnstile validation disabled while we diagnose intermittent
-// invalid-input-response rejections in v31. Flip back to true to re-enable.
-const TURNSTILE_ENABLED = false;
-
 // Worker setup
 export async function startWorker() {
   log.info(`Worker starting...`);
@@ -432,14 +428,11 @@ export async function startWorker() {
           return;
         }
 
-        // TEMPORARY: Turnstile validation disabled while we diagnose
-        // intermittent invalid-input-response rejections in v31.
-        // Re-enable by flipping TURNSTILE_ENABLED back to true.
-        if (TURNSTILE_ENABLED && config.env() !== GameEnv.Dev) {
+        if (config.env() !== GameEnv.Dev) {
           const turnstileResult = await verifyTurnstileToken(
             ip,
             clientMsg.turnstileToken,
-            config.turnstileSecretKey(),
+            config,
           );
           switch (turnstileResult.status) {
             case "approved":