Release 0.12.0: CloudFlare Turnstile on OTC email-entry

frontend/src/api.js

@@ -31,11 +31,19 @@ export async function getMe() {
 // migration — the new UI just no longer points at it primarily. These
 // two helpers drive the Login.jsx surface.
 
-export async function requestOtc(email) {
+export async function requestOtc(email, { turnstileToken } = {}) {
+  // v0.12.0 / roadmap item #10: when the Turnstile widget has produced
+  // a token, send it alongside the email so the backend can siteverify
+  // before the OTC dispatch. The backend treats a missing token as
+  // either soft-fail (no secret wired AND TURNSTILE_REQUIRED=false)
+  // or hard-fail (verification required) — the frontend stays
+  // uninvolved in the policy.
+  const body = { email }
+  if (turnstileToken) body.turnstile_token = turnstileToken
   const res = await fetch('/auth/otc/request', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ email }),
+    body: JSON.stringify(body),
   })
   return jsonOrThrow(res)
 }