Contact form pending — D5 wires the form with Cloudflare Turnstile validation and POSTs to /api/contact.