feat: add turnstile, hcaptcha, and recaptcha challenge types

[fionera]

Summary

Adds turnstile, hcaptcha, and recaptcha (v2 checkbox) as additional challenge types alongside none and pow — three public types backed by one shared implementation, since all providers use the same sitekey → widget token → siteverify flow. Replaces the split PRs #75/#76/#77.

The first commit is the babel 8 CI fix, shared with #74 — without it the web bundle doesn't build. Merge #74 first and it drops out of this diff, or merge this PR alone and close #74.

Server (validator_captcha.go)

• Challenge GET serves a static per-level JSON body {"c","t","k"} with the sitekey — no per-request state; security binding stays in the existing cookie HMAC. Web protocol numbering skips t:2 (reserved for worker POW), so captcha types are t:3/4/5.
• Challenge POST verifies the widget token against the provider's siteverify endpoint (form-encoded secret/response/remoteip), requires success and a hostname match against the request identity (subdomain-aware for trusted_domains). Fails closed on provider errors. First validator doing network I/O — the hot validate path is untouched; new injectable Berghain.HTTPClient with a 5s default timeout.
• Config: type: turnstile|hcaptcha|recaptcha + sitekey/secret, optional verify_url override and a test-only skip_hostname_check (provider test keys report a fixed hostname: example.com — confirmed against the live Cloudflare API). Validated at startup with Fatal.

Web (web/src/challange/)

• One shared solver for t:3–5: injects the provider script, renders the widget in explicit mode where the spinner sits, POSTs the token like the POW solver. Script URLs are hardcoded client-side so the external-domain allowlist stays auditable.
• Provider quirks found by driving the real page (documented in the descriptor table): turnstile.ready() throws for async-loaded scripts; grecaptcha queues ready() callbacks (useReady); hCaptcha signals readiness via a named onload= callback (useOnload).
• A blocked provider script (content blockers — the dominant real failure) surfaces actionable advice through the existing capability-advice UI.

Integration

• examples/haproxy/berghain.cfg: validate and challenge now run as separate SPOE agents — berghain keeps timeout processing 100ms, berghain_challenge gets 6s for the siteverify round-trip.
• e2e gains a second frontend (:18081) with a turnstile level using Cloudflare's always-passing dummy keys, driven by the same chromedp flow as the POW test.
• README captcha section (egress, fail-closed, timeout split, hostname binding, CSP note); visitor help page documents the captcha type and the third-party-script exception.

Test plan

• go test ./... — 8 new tests against an httptest siteverify stub: GET body shape, happy path (asserting all form fields), subdomain match, rejected token, hostname mismatch, skip-hostname flag, provider 5xx + dead provider fail closed, empty/oversized bodies, hostname-matcher table test. staticcheck v0.6.1 clean.
• npm run lint / npm test (15/15, five new) / npm run build.
• Drove the built bundle in headless Chrome: Turnstile dummy key auto-solves and POSTs its token; hCaptcha/reCAPTCHA widgets render with no console warnings.
• ./test/e2e/run.sh locally (HAProxy 3.4): TestBrowserSolvesChallenge (POW) and TestBrowserSolvesTurnstileChallenge both pass against the real Turnstile endpoints; haproxy -c validates the example config.

🤖 Generated with Claude Code