fix(auth): gate protected actions on Turnstile

[StringKe]

What changed

• Disable every Turnstile-protected Hosted Auth action until public auth configuration resolves and the widget yields a token.
• Apply the same gate to password, magic link, OTP delivery, enterprise SSO, social providers, passkey conditional UI, guest entry, and password reset.
• Mount the Turnstile widget before the protected controls so the required interaction is visible before users reach disabled actions.
• Enforce the gate both in rendered controls and in action handlers to cover keyboard and programmatic entry paths.
• Record the interaction invariant in the English and Simplified Chinese authentication design sources.

Root cause

Production uses the Turnstile interaction-only widget. Protected actions stayed enabled before a challenge token existed, so users could submit turnstileToken: null and receive a generic security-verification failure without any email being queued. This made valid Magic Link and password-reset flows appear broken.

User impact

Users are guided to complete the visible security challenge before authentication or recovery controls become available. Submissions can no longer race ahead of Turnstile readiness.

Validation

• pnpm check
• pnpm test
• Server Worker: 224 files, 2667 tests PASS
• Hosted Auth SPA: 51 files, 212 tests PASS
• Focused Turnstile coverage: 6 files, 35 tests PASS
• git diff --check
• staged sensitive-data scan PASS