Transparent and non-JavaScript challenge suite #90

What

Add low-friction browser checks that do not require expensive PoW or a third-party CAPTCHA.

Current state

The available flows are none, PoW, and provider-backed CAPTCHA. The none validator grants clearance on GET and relies on frontend JavaScript to reload.

Sketch

• Add backend-session, Early Hints preload, cookie round-trip, refresh, and resource-load checks.
• Include a manual fallback for browsers without JavaScript.