Cannot post a comment on an event — submit silently fails

## What happens You type a comment on an event page, hit **Post**, and nothing happens. No comment appears, and there's no clear error message explaining why. Trying again has the same result. This affects **every** comment attempt on every event — both top-level comments and replies to other comments. It's effectively impossible to use the comments feature on the dev environment right now. ## How to reproduce 1. Open any event page on `dev.gathrings.com` while logged in. 2. Scroll to the comments section. 3. Type something into the comment box and click **Post**. 4. Nothing happens — the comment isn't saved and isn't shown. ## What's actually broken (technical) The site uses **Cloudflare Turnstile** (an anti-bot "prove you're human" check) to gate comment posting. The backend confirmed via Cloudflare's response code `missing-input-response` that the frontend never sends the verification token. The Turnstile chain is missing every link from the editor down to the BFF — each piece individually is half-built; nothing connects: - **Layer 1 — Editor never renders the widget.** `features/events/components/CommentSection.tsx:215` and 3 sites in `CommentThread.tsx` mount `<RichTextEditor>` without the `turnstileSiteKey` prop. The editor supports it (verified in `RichTextEditorInner.tsx:228`); it just isn't passed. - **Layer 2 — Submit handler discards the token.** `CommentSection.tsx:134` is `handleRootSubmit(html: string)`. The editor calls it as `onSubmit(html, turnstileToken)` per its own contract, but the second arg is silently dropped. - **Layer 3 — `createComment` API doesn't accept a token.** `features/events/api/comments.api.ts:125` signature is `createComment(eventId, body, parentId)`. No 4th arg, no header set on the `fetch`. - **Layer 4 — BFF handler doesn't forward a header.** `app/api/events/[id]/comments/handler.ts:146` builds the upstream fetch with only `authorization` and `content-type`. No `X-Turnstile-Token` propagated — even if the frontend sent one, the BFF would drop it. All 4 layers need to be fixed for comments to work end-to-end. ## Side note (separate, harmless but wrong) The BFF proxies to `/v1/v1/events/{id}/comments` — the `/v1` prefix is duplicated. FastAPI happens to match it currently, so it doesn't break anything yet, but it should be fixed to `/v1/events/{id}/comments` while the file is being touched. ## Workaround for testing on dev Clear or empty `TURNSTILE_SECRET_KEY` on the dev API. The backend's `verify_turnstile_token` is gated to skip when unconfigured, so comments will go through without the bot check. Don't do this on prod. ## Impact - Comment feature is **completely unusable** on dev right now. - Will be unusable on prod the moment Turnstile is configured there too, unless this fix lands first. - No user-visible error means people will think their comment posted when it didn't — silent data loss from the user's perspective. ## Found by Manual testing on dev; backend logs surfaced Cloudflare's `missing-input-response`.