feat(hub): replace reCAPTCHA with a self-hosted proof of work

Sign-up and passphrase reset sent every visitor's address and browser
details to Google, which needed a consent the sign-up form could not ask
for freely. The hub now issues its own challenge (ALTCHA's scheme, signed
with a key derived from the hub's private key, single-use, 30 minutes)
and the page solves it with SubtleCrypto while the form is filled in.

- GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off.
- [captcha] enabled / max_number replace site_key / secret_key, which are
  now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old
  variables.
- No Google origin left in the CSP of the hub, the desktop shell or the
  Android shell; captcha_site_key leaves /v1/hub/info.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 1 insertions, 0 deletions

diff --git a/docs/MESHBAY_HTTP_API.md b/docs/MESHBAY_HTTP_API.md
index 73d079d..be4e7e2 100644
--- a/docs/MESHBAY_HTTP_API.md
+++ b/docs/MESHBAY_HTTP_API.md
@@ -40,6 +40,7 @@ hub also serves the web application at `/` and `/app/`, which are not listed.
 
 | Method | Path | Auth | What |
 |---|---|---|---|
+| GET | `/v1/users/captcha` | none | A proof-of-work challenge for the register and reset-request forms. |
 | POST | `/v1/users/register` | none | Create an account. |
 | POST | `/v1/users/verify-email` | none | Verify a registration email with the code received by mail. |
 | POST | `/v1/users/me/bundle-pepper` | user | The pepper, for a session that has just been given the passphrase again. |