Add Turnstile protection to user actions

app/(payload)/api/contact/inquiry/route.ts

@@ -5,6 +5,7 @@ import config from "@payload-config";
 import { getClientIp, checkRateLimit } from "@/lib/auth/rateLimit";
 import { newConversationAdminEmail } from "@/lib/email/conversationTemplates";
 import { sendEmail } from "@/lib/email/sendBookingEmails";
+import { verifyTurnstileToken } from "@/lib/turnstile/server";
 
 export const dynamic = "force-dynamic";
 
@@ -14,6 +15,7 @@ type Body = {
   message?: unknown;
   subject?: unknown;
   type?: unknown;
+  token?: unknown;
 };
 
 function clean(value: unknown, max: number): string {
@@ -37,6 +39,9 @@ export async function POST(request: Request) {
   if (!name || !email || !message || !/^\S+@\S+\.\S+$/.test(email)) {
     return NextResponse.json({ error: "Bitte fülle alle Pflichtfelder korrekt aus." }, { status: 400 });
   }
+  if (!(await verifyTurnstileToken(body.token, "contact", request))) {
+    return NextResponse.json({ error: "Sicherheitsprüfung fehlgeschlagen. Bitte versuche es erneut." }, { status: 403 });
+  }
   if (!checkRateLimit(`contact:ip:${getClientIp(request)}`, { max: 8, windowMs: 60 * 60 * 1000 })) {
     return NextResponse.json({ error: "Zu viele Anfragen. Bitte versuche es später erneut." }, { status: 429 });
   }