Split compose dev/prod and relax contact form friction.

Use compose.dev.yaml and compose.prod.yaml with fixed Go cache mounts, block sudo make dev, build Air outside app/tmp for rootless Docker, soften English spam checks, and simplify contact error copy.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/internal/contactcheck/form.go

@@ -9,17 +9,18 @@ import (
 const HoneypotField = "website"
 
 // MinFormFillDuration is the minimum time between showing the form and submit.
-const MinFormFillDuration = 3 * time.Second
+const MinFormFillDuration = 5 * time.Second
 
 // SpamHoneypot reports whether the honeypot was filled (likely spam).
 func SpamHoneypot(value string) bool {
 	return strings.TrimSpace(value) != ""
 }
 
-// FormFilledTooFast reports whether the form was submitted before seenUnix (0 = never seen).
+// FormFilledTooFast reports whether the form was submitted before seenUnix.
+// Missing timing data (seenUnix <= 0) is allowed — honeypot and rate limits still apply.
 func FormFilledTooFast(seenUnix int64, now time.Time) bool {
 	if seenUnix <= 0 {
-		return true
+		return false
 	}
 	return now.Sub(time.Unix(seenUnix, 0)) < MinFormFillDuration
 }