fix(auth): add 15s timeout to Turnstile captcha promise

Prevents form from hanging indefinitely if Turnstile never fires
onSuccess/onError (e.g. script fails to load, network drop).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/(auth)/login/login-form.tsx

@@ -189,11 +189,16 @@ export default function LoginPage({
       if (turnstileSiteKey && turnstileRef.current) {
         try {
           turnstileRef.current.reset()
-          token = await new Promise<string>((resolve, reject) => {
-            captchaResolveRef.current = resolve
-            captchaRejectRef.current = reject
-            turnstileRef.current?.execute()
-          })
+          token = await Promise.race([
+            new Promise<string>((resolve, reject) => {
+              captchaResolveRef.current = resolve
+              captchaRejectRef.current = reject
+              turnstileRef.current?.execute()
+            }),
+            new Promise<string>((_, reject) =>
+              setTimeout(() => reject(new Error('Captcha timed out')), 15_000)
+            ),
+          ])
         } catch {
           setPasswordErrors(['Captcha verification failed. Please try again.'])
           setShowValidationError(true)

apps/sim/app/(auth)/signup/signup-form.tsx

@@ -256,11 +256,16 @@ function SignupFormContent({
       if (turnstileSiteKey && turnstileRef.current) {
         try {
           turnstileRef.current.reset()
-          token = await new Promise<string>((resolve, reject) => {
-            captchaResolveRef.current = resolve
-            captchaRejectRef.current = reject
-            turnstileRef.current?.execute()
-          })
+          token = await Promise.race([
+            new Promise<string>((resolve, reject) => {
+              captchaResolveRef.current = resolve
+              captchaRejectRef.current = reject
+              turnstileRef.current?.execute()
+            }),
+            new Promise<string>((_, reject) =>
+              setTimeout(() => reject(new Error('Captcha timed out')), 15_000)
+            ),
+          ])
         } catch {
           setPasswordErrors(['Captcha verification failed. Please try again.'])
           setShowValidationError(true)