feat(scheduling): pluggable captcha (Turnstile) on public booking

services/platform-api/src/scheduling/public/dto/public-dtos.ts

@@ -20,6 +20,13 @@ export class SlotsQueryDto {
 export class CreateHoldDto {
   @IsISO8601()
   startUtc!: string
+
+  // Optional captcha token (e.g. Cloudflare Turnstile). Enforced server-side
+  // only when a captcha provider is configured; ignored otherwise.
+  @IsOptional()
+  @IsString()
+  @MaxLength(4096)
+  captchaToken?: string
 }
 
 export class CreateBookingDto {
@@ -48,6 +55,13 @@ export class CreateBookingDto {
   @IsString()
   @MaxLength(64)
   holdId?: string
+
+  // Optional captcha token (e.g. Cloudflare Turnstile). Enforced server-side
+  // only when a captcha provider is configured; ignored otherwise.
+  @IsOptional()
+  @IsString()
+  @MaxLength(4096)
+  captchaToken?: string
 }
 
 export class CancelBookingDto {