fix: restore security hardening compatibility and validation

Restore authorized rule reveal, explicit full HTTP capture and retention, video task business fields, and valid payment URLs. Add opt-in credential preservation for trusted recovery, fix frontend type contracts and async races, and eliminate PostgreSQL test fixture resource leaks. Document audit coverage and successful fmt and CI-scoped Clippy checks.

frontend/src/features/auth/components/TurnstileWidget.vue

@@ -163,6 +163,7 @@ async function execute(action: string): Promise<string> {
   if (!turnstile || !container || !turnstile.execute) {
     throw new Error('Turnstile unavailable')
   }
+  const execute = turnstile.execute.bind(turnstile)
 
   clearWidget()
 
@@ -191,7 +192,7 @@ async function execute(action: string): Promise<string> {
       },
     })
     widgetId.value = id
-    turnstile.execute(id)
+    execute(id)
   })
 }