Direct Form
Protected by Turnstile, posted to Pages Functions.
The form submits to /api/contact. The endpoint verifies Turnstile before accepting the message,
so the page does not have to publish your email address anywhere in the HTML.