Implement two-layer CAPTCHA bypass

.env.example

@@ -14,6 +14,12 @@ VITE_TURNSTILE_SITE_KEY=your-turnstile-site-key
 # Cloudflare Images Configuration
 VITE_CLOUDFLARE_ACCOUNT_HASH=your-cloudflare-account-hash
 
+# CAPTCHA Bypass Control (Development/Preview Only)
+# This acts as a safety gate - even if admins enable bypass in settings,
+# it will only work if this is set to 'true'
+# MUST be 'false' or unset in production
+VITE_ALLOW_CAPTCHA_BYPASS=false
+
 # Novu Configuration
 # For Novu Cloud, use these defaults:
 # - Socket URL: wss://ws.novu.co