Module captcha 

CAPTCHA token verification for hCaptcha, Cloudflare Turnstile, Google reCAPTCHA v3.

Apps wire CAPTCHA into endpoints that bots love (magic-code send, password register, account creation) by:

1. Setting PYLON_CAPTCHA_PROVIDER (hcaptcha | turnstile | recaptcha) and PYLON_CAPTCHA_SECRET (server-side secret from the provider).
2. Frontend includes the CAPTCHA widget; user-supplied token arrives in the captchaToken JSON field on the request.
3. Pylon endpoints check CaptchaConfig::from_env() and call verify() before processing — failure returns 400.

All three providers expose a similar shape: POST a token to a verify endpoint, get back {"success": bool, …}. We collapse them to one trait + one config so the host app decides “do I have CAPTCHA enabled?” not “which CAPTCHA?”

Structs

CaptchaConfig

Enums

CaptchaProvider

Which CAPTCHA service the app uses. Reads PYLON_CAPTCHA_PROVIDER.