feat: Cloudflare Turnstile on auth, CSP fixes, admin/SEO/analytics additions

Turnstile bot protection (sign-in, sign-up, password-reset):
- Register Better Auth's captcha plugin with the cloudflare-turnstile
  provider; endpoints listed explicitly rather than relying on defaults.
  /reset-password is intentionally excluded — it is reached only via a
  single-use emailed token.
- Add an explicit-render Turnstile widget component. Tokens are single-use,
  so each form resets the challenge after a failed submit; submit stays
  disabled until a token is held.
- Read the site key server-side and pass it down as a prop, so rotating it
  does not require a rebuild.
- Fail fast in production when TURNSTILE_SECRET_KEY is missing, and when a
  secret is set without a site key (that combination would demand a token
  no form can produce, locking every user out).
- Pass a throwaway secret during `next build` in the Dockerfile, mirroring
  the existing BETTER_AUTH_SECRET treatment, so image builds don't need it.

CSP fixes in middleware (these blocked Turnstile entirely):
- Add frame-src for challenges.cloudflare.com. Without it the widget's
  iframe fell back to default-src 'self' and was blocked outright.
- Allow 'unsafe-eval' and websockets in DEVELOPMENT only. `next dev`
  compiles with eval(), so the strict policy threw EvalError and killed
  hydration — no client JS ran at all, which also meant form submit
  handlers never fired. Production policy is unchanged and still strict.

Also included (concurrent work in the tree):
- Admin organizations pages and lib/admin/orgs.
- Episode moderation migration, SEO metadata (sitemap, robots, JSON-LD,
  OG/Twitter images, manifest), Umami analytics, not-found page.

Local dev database: docker-compose.dev.yml provisions Postgres 18 on port
5443 (5432-5442 are in use by other local projects).

Note: `npx tsc --noEmit` currently fails in app/(app)/team/page.tsx — an
`invitations` prop the component does not accept. This predates the commit
and will fail `next build` until fixed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/not-found.tsx

@@ -0,0 +1,65 @@
+import type { Metadata } from "next";
+import Link from "next/link";
+import { ArrowRight } from "lucide-react";
+import { SiteFooter } from "@/components/marketing/site-footer";
+import { SiteHeader } from "@/components/marketing/site-header";
+import { Button } from "@/components/ui/button";
+import { NO_INDEX } from "@/lib/seo";
+
+// A 404 already carries the right status code; the meta tag is belt-and-braces
+// for crawlers that reach this shell through a soft link.
+export const metadata: Metadata = { title: "Page not found", ...NO_INDEX };
+
+/** Popular destinations, so a bad URL still routes the visitor somewhere useful. */
+const LINKS: [string, string][] = [
+  ["Features", "/features"],
+  ["Pricing", "/pricing"],
+  ["FAQ", "/faq"],
+  ["About", "/about"],
+];
+
+export default function NotFound() {
+  return (
+    <div className="flex min-h-screen flex-col">
+      <SiteHeader />
+      <main className="flex flex-1 items-center bg-hero-wash">
+        <div className="container max-w-2xl py-24 text-center md:py-32">
+          <p className="text-[13px] font-semibold uppercase tracking-[0.04em] text-brand">
+            Error 404
+          </p>
+          <h1 className="mt-3 font-display text-5xl font-extrabold tracking-tight md:text-6xl">
+            We couldn&apos;t find that page
+          </h1>
+          <p className="mx-auto mt-4 max-w-lg text-lg text-muted-foreground">
+            The link may be broken, or the page may have moved. Here are a few places to
+            pick things back up.
+          </p>
+
+          <div className="mt-9 flex flex-col justify-center gap-3 sm:flex-row">
+            <Button asChild size="lg">
+              <Link href="/">
+                Back to home <ArrowRight className="h-4 w-4" />
+              </Link>
+            </Button>
+            <Button asChild size="lg" variant="outline">
+              <Link href="/sign-up">Start free</Link>
+            </Button>
+          </div>
+
+          <nav aria-label="Popular pages" className="mt-12">
+            <ul className="flex flex-wrap justify-center gap-x-6 gap-y-3 text-sm">
+              {LINKS.map(([label, href]) => (
+                <li key={href}>
+                  <Link href={href} className="font-semibold text-brand hover:underline">
+                    {label}
+                  </Link>
+                </li>
+              ))}
+            </ul>
+          </nav>
+        </div>
+      </main>
+      <SiteFooter />
+    </div>
+  );
+}