fix(faucet): restore runtime CAPTCHA and v3 labeling

[moscowchill]

Summary

• Deliver the public Turnstile site key through the runtime faucet status response so builds remain independent of CAPTCHA configuration.
• Preserve server CAPTCHA enforcement and explicitly serialize only public status fields, with no-store caching.
• Show clear unavailable/loading errors, reject stale widget callbacks, and label the faucet as QRL Testnet v3.
• Add unit and local browser regressions for runtime-only configuration, missing or blocked CAPTCHA, token expiry, and phone/desktop layouts.

Validation

• npm ci, npm test -- --runInBand: 612 tests in 46 suites passed.
• npm run lint: zero errors, 14 existing warnings. npx tsc --noEmit and API documentation drift check passed.
• Scoped formatting and outgoing whitespace/privacy checks passed. No formatter configuration or format script is defined by this repository.
• Production build passed with the browser site key absent and the unaffected hosted example prebuild skipped; deployment preserves the existing hosted example bytes.
• Five Playwright regressions passed against the production build, covering phone/desktop token gating and missing key, blocked script and malformed status failures. Initial assertions were scoped to the faucet region to exclude the framework route announcer.
• Three compiled-server fixtures verified runtime key changes without rebuilding, no-store and the exact public response whitelist.
• Independent review passed 20 additional boundary/lifecycle cases.

Human CAPTCHA completion and an actual funded payout remain separate acceptance steps. Browser fixtures intercept claim requests and submit zero transactions.

Scope and rollout

Frontend-only release with retained rollback. No dependency, signing, CAPTCHA bypass, cooldown, node, chain-state or database migration changes. The hosted dApp example remains byte-identical to its deployed artifact.