Add Turnstile timing to search stats

[xenodus]

Summary

Surfaces Cloudflare Turnstile challenge time as its own row in the search stats Client timing table, separate from session mint (GET /session fetch) and search response.

Changes

Code

• apiSession.js: Measure turnstileDurationMs around requestTurnstileToken(); sessionMintDurationMs now covers only the /session fetch (excluding Turnstile).
• useSearch.js, searchUrl.js, App.jsx: Plumb turnstileDurationMs through search state and browser history snapshots.
• SearchStats.jsx: Show a Turnstile row when timing is > 0 (hidden when Turnstile is disabled or the session was already cached).

Docs

• docs/api-abuse-mitigation.md: Turnstile in intro; browser sequence diagram shows Lambda → Cloudflare siteverify; Cloudflare Turnstile subsection documents frontend + backend roles and error responses; search-stats client-timing note.
• docs/architecture.md: Backend Turnstile verification in Lambda section; system diagram shows SearchLambda → siteverify; external services table covers browser + Lambda; Browser session and search explains two-sided control.
• README.md, AGENTS.md: Turnstile in API abuse-mitigation overview.

Testing

• make test (Go) — pass
• go fix ./... — no changes
• Local UI verification blocked: dev server proxies to production API (CORS); Turnstile row appears in production when VITE_TURNSTILE_SITE_KEY is configured and a fresh session mint runs during search.

Privacy policy

No change — no new data collection (Turnstile was already disclosed in the privacy modal).