feat(wave): add CAPTCHA to repo application form

[efstajas]

Adds the Cloudflare Turnstile (CAPTCHA) check to the repo application form — the maintainer-onboarding "apply repos to a wave program" flow — mirroring the pattern already used on the issue application page.

This is the frontend counterpart required by the backend PR https://github.com/drips-network/wave/pull/662, which adds requireCaptcha to POST /api/wave-programs/:waveProgramId/repos/apply. Without this, that endpoint would reject submissions in environments where Turnstile is configured.

Changes

• src/lib/utils/wave/wavePrograms.ts — batchApplyRepos now accepts an optional turnstileToken and forwards it as the x-turnstile-token header (only when present), matching applyToWorkOnIssue.
• .../apply-to-wave-program/[waveProgramId]/form/+page.svelte (last step of the repo application form):
  • Renders the existing reusable Turnstile widget in a Verification* FormField (shown once KYC is verified), just before the submit button.
  • Adds turnstileToken state and folds !!turnstileToken into formValid, so "Apply selected repos" stays disabled until the challenge is solved.
  • Passes the token into the batchApplyRepos call.

Reuses all existing Turnstile infra (Turnstile component, PUBLIC_TURNSTILE_SITE_KEY, the Cloudflare script in app.html) — same approach as the issue application page.

Notes

• The backend middleware skips verification when TURNSTILE_SECRET_KEY is unset, so this is a no-op locally without the key.

Verification

• svelte-check passes with 0 errors.