Signup OTP reCAPTCHA

Controls Google reCAPTCHA v3 on signup OTP send and on marketing contact forms (POST /submit-form). Same site key and score threshold for both. Disabled by default after deploy; enable here when ready. Secret key stays in API env (RECAPTCHA_SECRET_KEY). The Google key must allow the marketing host (www.sendsteps.com and staging). If genuine contact mail is blocked, lower the threshold toward 0.3.