Add contact antispam and fix gallery video playback.

English-only messages, rate limiting, min fill time, and normalized email
validation; improve modal video serving with posters, correct MIME types, and
no gzip on gallery media.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/internal/contactcheck/form_test.go

@@ -0,0 +1,30 @@
+package contactcheck
+
+import (
+	"testing"
+	"time"
+)
+
+func TestSpamHoneypot(t *testing.T) {
+	if !SpamHoneypot("filled") {
+		t.Fatal("expected honeypot trip")
+	}
+	if SpamHoneypot("  ") {
+		t.Fatal("expected empty honeypot")
+	}
+}
+
+func TestFormFilledTooFast(t *testing.T) {
+	now := time.Unix(1_000_000, 0)
+	seen := now.Add(-MinFormFillDuration).Unix()
+
+	if !FormFilledTooFast(0, now) {
+		t.Error("missing seen time should be too fast")
+	}
+	if !FormFilledTooFast(seen+1, now) {
+		t.Error("submit before min duration should be too fast")
+	}
+	if FormFilledTooFast(seen, now) {
+		t.Error("submit at min duration should be allowed")
+	}
+}