feat: support FCaptcha verification

[cport1]

Summary

Add FCaptcha as a third CAPTCHA verification provider for self-hosted Auth deployments.

Design

FCaptcha exposes the same form-encoded Siteverify contract already consumed by Auth for hCaptcha and Turnstile. Unlike those hosted providers, its verification endpoint belongs to the operator, so this adds one provider-specific setting: SECURITY_CAPTCHA_PROVIDER_URL.

When SECURITY_CAPTCHA_PROVIDER=fcaptcha:

• configuration requires an absolute HTTP(S) base URL
• userinfo, query strings, and fragments are rejected
• Auth posts secret, response, and remoteip to <base>/siteverify
• the existing verification response model and middleware behavior remain unchanged

The configured URL is administrator-controlled, not request-controlled. HTTP remains supported because self-hosted Auth and FCaptcha commonly communicate over a private container network; operators can use HTTPS for external endpoints.

Client behavior

This change concerns server-side token verification. A custom/self-hosted frontend renders FCaptcha and sends its token through the existing captcha_token request field, so the Auth API contract does not change.

Validation

• go test ./internal/security ./internal/conf ./internal/reloader
• added an httptest assertion covering the exact Siteverify path and form fields
• added configuration validation/normalization coverage
• updated example and reloader fixture environments

Documentation

README configuration now lists FCaptcha and explains how the provider URL and verify secret map to a self-hosted FCaptcha instance.