Captcha Config

Return whether the caller should use captcha test keys.

The FE calls this on page load (fire-and-forget). If the caller's IP is in CAPTCHA_TEST_MODE_IPS the widget will use the always-pass test site key and the BE will validate against the corresponding test secret.

Non-whitelisted callers receive use_test_captcha: false and the normal prod key pair is used — captcha remains fully enforced for all users.