toneforge

docs: add anti-spam docs, Caddy reference, CSP pitfall to CLAUDE.md

fix: allow Cloudflare Turnstile in CSP (script-src, connect-src, frame-src)

fix: address code review findings for anti-spam implementation

security: add anti-spam measures (Turnstile, honeypot, disposable email, email verification)

docs: extract deployment/SysEx details from CLAUDE.md into dedicated docs