feat: integrate Cloudflare Turnstile captcha for login and signup

[AkshatVerma087]

📌 Description

Replaced the custom math-based captcha with Cloudflare Turnstile — a privacy-friendly, managed captcha widget. The old approach required a server-generated math question, a JWT-signed answer token, and manual user input. Turnstile handles the entire challenge client-side and verifies server-side with a single API call, resulting in a cleaner UX and simpler codebase.

🔗 Related Issue

Closes #352

🛠 Changes Made

• Replaced custom math captcha component with a reusable Cloudflare Turnstile widget (frontend/src/components/Captcha.jsx) with auto dark/light theme detection
• Rewrote backend/utils/captchaUtils.js to verify Turnstile tokens via Cloudflare's siteverify API (gracefully skips if secret key is not set in dev)
• Updated authController.js — simplified to use only captchaToken (removed captchaAnswer and getCaptcha export)
• Removed GET /captcha route from authRoutes.js (Turnstile handles challenge client-side)
• Updated Login.jsx and Signup.jsx to use new <Captcha onVerify={...} /> flow
• Added axios to backend dependencies (for Turnstile API calls)
• Added react-turnstile to frontend dependencies
• Updated both .env.example files with required Turnstile env vars

📸 Screenshots

✅ Checklist

• Code runs locally
• Followed project structure
• No console errors
• Properly tested changes
• Linked the issue

🚀 Notes for Reviewers

• New env vars required:
  • VITE_TURNSTILE_SITE_KEY in frontend/.env
  • TURNSTILE_CLOUDFARE_SECRET_KEY in backend/.env
• Keys can be obtained from the Cloudflare Turnstile dashboard
• If TURNSTILE_CLOUDFARE_SECRET_KEY is not set, captcha verification is skipped — existing dev setups won't break
• Cloudflare test keys (for local dev): Site key 1x00000000000000000000AA, Secret key 1x0000000000000000000000000000000AA

I am GSSoC participant please give me good rating and accept my merge request @aryandas2911 .

[YLaxmikanth]

Great refactor overall — replacing the custom math captcha with Cloudflare Turnstile significantly improves the authentication flow and reduces unnecessary backend/frontend complexity. The reusable captcha component, cleanup of old routes, and environment variable updates are all well structured.

One suggestion: the current fallback behavior that skips captcha verification when the secret key is missing should ideally be restricted to development environments only, to avoid accidental production misconfiguration.

Also, consider adding clearer UI feedback for expired or failed captcha verification to improve user experience further.

Overall, this looks like a solid and production-friendly enhancement.

[AkshatVerma087]

Thanks for your insights @YLaxmikanth I'll work on that.