Add simple anti-spam checks to contact form

[MateoLostanlen]

Summary

Adds two lightweight anti-spam protections to the contact form:

• an invisible honeypot field for basic bots
• a simple required 3 + 3 question before submit

The captcha answer is checked client-side and excluded from the submitted payload. This is intended to reduce simple form-filling spam; a stronger follow-up would enforce the same checks in the Google Apps Script before sending the email.

Validation

• Ran the site with docker compose up -d --build
• Checked that http://localhost:4000/ returns 200 OK
• Confirmed the contact form renders the anti-spam question
• Confirmed the Spanish form renders Tu mensaje