Protect a Hono POST route with self-hosted CAPTCHA verification

A form can look protected while its POST endpoint still accepts unchecked requests. The useful boundary is the server: verification must complete before the operation that sends mail, saves data, or g