Block bot registrations and add cron cleanup for unconfirmed accounts

register.php was a fully open signup form with no bot defenses — the
likely source of the unconfirmed accounts piling up in admin/users.php.

- Add an always-on honeypot field + timing trap to register.php: either
  tripping silently pretends success without creating an account, so a
  bot doesn't learn it was caught. No configuration needed.

- Add optional Google reCAPTCHA v3 support (includes/recaptcha.php,
  recaptcha_enabled()/verify_recaptcha(), no Composer dependency — a
  raw file_get_contents() POST like mailer.php's SMTP socket approach).
  A failed check here shows a real, visible error instead of the silent
  honeypot path, since a legitimate low-score user deserves a retry.

- Configure it through admin/settings.php's new "Bot Protection" section,
  mirroring the existing SMTP pattern exactly: recaptcha_enabled/
  recaptcha_site_key/recaptcha_secret_key in site_settings, secret key
  masked the same way smtp_pass now is (blank submission keeps it
  unchanged). install.php seeds sane defaults so the feature stays off
  until explicitly configured — fully backward compatible.

- Add cron/cleanup_unconfirmed.php: deletes accounts still unconfirmed
  after 3 days. CLI-only (refuses to run over HTTP, and cron/.htaccess
  denies web access to the directory as a second layer) since it's an
  unattended, irreversible deletion. Safe by construction — login.php
  already refuses login to unconfirmed accounts, so these rows can never
  own a session/novena_group/custom_prayer row. Not wired up
  automatically; README documents the Hostinger cron job to schedule it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -64,6 +64,20 @@ chmod 755 uploads/
 
 Configure outbound email in **Admin → Settings** for registration confirmation and password reset emails. If left blank, the app will auto-confirm new users instead.
 
+### 6. Bot protection (optional)
+
+`register.php` always runs a built-in honeypot + timing trap against scripted signups — no setup needed. On top of that, you can enable Google reCAPTCHA v3: register your domain at [google.com/recaptcha](https://www.google.com/recaptcha/admin) (choose **reCAPTCHA v3**), then enter the Site Key and Secret Key in **Admin → Settings → Bot Protection**.
+
+### 7. Scheduled cleanup of unconfirmed accounts (optional)
+
+`cron/cleanup_unconfirmed.php` permanently deletes accounts that are still unconfirmed 3 days after registering — useful for clearing out bot signups that get past the defenses above. It's CLI-only (refuses to run over HTTP) and is not wired up automatically; schedule it yourself as a cron job. In Hostinger's hPanel: **Advanced → Cron Jobs** → run daily:
+
+```bash
+php /home/<your-account>/domains/loveandrosary.com/public_html/cron/cleanup_unconfirmed.php
+```
+
+(Adjust the path to match your actual hosting account.) Confirmed accounts are never touched — only rows with `email_confirmed = 0`.
+
 ## Upgrading an Existing Install
 
 `schema.sql` reflects the current database structure. For a production database that predates the `failed_login_attempts` / `locked_until` login-lockout columns, run this once against it manually — it's not applied automatically since there's no migration runner against a live database:
@@ -101,11 +115,14 @@ Rosary/
 ├── config/
 │   ├── db.example.php  # Copy → db.php and fill in credentials
 │   └── db.php          # (gitignored — contains real credentials)
+├── cron/
+│   └── cleanup_unconfirmed.php  # CLI-only; schedule via host cron
 ├── data/
 │   └── prayers.php     # All prayer text + build_decade_slides()
 ├── includes/
 │   ├── auth.php        # require_auth(), current_user(), has_role(), login lockout
 │   ├── csrf.php        # csrf_token(), csrf_field(), csrf_verify()
+│   ├── recaptcha.php   # recaptcha_enabled(), verify_recaptcha()
 │   ├── build_slides.php
 │   ├── donate.php
 │   └── mailer.php