feat(botid): add Vercel BotID to the four public forms (observe mode)

[ignmandagaran]

Summary

Adds Vercel BotID — an invisible CAPTCHA — to the four public forms. The contact form has no validation today and emails sales@basement.studio on every submit.

Nothing is blocked here. The actions call checkBotId(), report the verdict, then proceed as before. Suspected bots still reach Resend and Notion; their contact emails arrive prefixed [SUSPECTED BOT] so sales@ can judge accuracy first. Enforcement is a follow-up PR, once there's data.

Observe-first because BotID fails closed: a route missing from the client protect list gets no challenge headers, so a real visitor reads as a bot — on a lead form, a silently lost lead.

Changes

• botid@^1.5.11; withSentryConfig(withBotId(nextConfig), …)
• initBotId() lists all 13 (site) routes, not just /contact — the contact overlay is mounted in (site)/layout.tsx and a server action POSTs to whatever page invoked it
• checkBotId() in the three actions, after the honeypot/rate-limit so free checks short-circuit first
• src/lib/botid.ts reports via console.error + track("botid_detected"), not Sentry — attacker-triggerable and no sampleRate is set, so captureMessage would be unbounded under the very flood it reports on
• Deep Analysis off; no checkLevel set, so it stays a dashboard toggle

Checklist

• pnpm lint passes
• Tested locally in dev mode
• No breaking changes — no action returns anything different than today

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
website-2k25	Ready	Preview	Aug 14, 2026 2:04pm

[greptile-apps]

Greptile Summary

Adds Vercel BotID in observation mode to the newsletter, contact, and careers server actions without rejecting suspected bots.

• Configures BotID’s Next.js integration and protected POST routes.
• Reports suspected submissions through logs and Vercel Analytics.
• Prefixes suspected contact emails while preserving provider submissions.
• Wraps error-catching server actions with Sentry instrumentation.

Confidence Score: 5/5

The PR appears safe to merge, with no unacknowledged blocking or independently actionable non-blocking issues identified.

The protected route patterns cover the normal form surfaces, suspected bots continue to the existing providers, and telemetry failures are contained on the reachable server-action paths.

_{Reviews (1): Last reviewed commit: 4c1c76f | Re-trigger Greptile}