Add contact antispam and fix gallery video playback.

English-only messages, rate limiting, min fill time, and normalized email
validation; improve modal video serving with posters, correct MIME types, and
no gzip on gallery media.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/internal/contactcheck/form.go

@@ -0,0 +1,25 @@
+package contactcheck
+
+import (
+	"strings"
+	"time"
+)
+
+// HoneypotField is the form field bots should leave blank (hidden from users).
+const HoneypotField = "website"
+
+// MinFormFillDuration is the minimum time between showing the form and submit.
+const MinFormFillDuration = 3 * time.Second
+
+// SpamHoneypot reports whether the honeypot was filled (likely spam).
+func SpamHoneypot(value string) bool {
+	return strings.TrimSpace(value) != ""
+}
+
+// FormFilledTooFast reports whether the form was submitted before seenUnix (0 = never seen).
+func FormFilledTooFast(seenUnix int64, now time.Time) bool {
+	if seenUnix <= 0 {
+		return true
+	}
+	return now.Sub(time.Unix(seenUnix, 0)) < MinFormFillDuration
+}