Function
Reads the public site key from NEXT_PUBLIC_TURNSTILE_SITE_KEY; local
development and the e2e suite use Cloudflare's always-pass test key. The
widget is shown in the page's language and sits in a labelled group so
assistive technology can name it.
On the development server the widget is always visible, in space the form
reserves for it, so you can see the challenge ran. In every other build it
uses Cloudflare's interaction-only appearance. It stays hidden and only
appears when Cloudflare needs the visitor to click. While hidden it is
absolute, so it takes no part in the parent's layout, not even a flex
gap. It rejoins the layout for good once Cloudflare surfaces it: before an
interactive check, or to report an error or an unsupported browser.
A token is single-use: after a submission, remount the component (change
its key) to get a fresh one.
Cloudflare Turnstile, the bot check on the sign-up, sign-in and forgot-password forms.