feat(contact-us): add time-trap spam protection to contact form

[vvlladd28]

Summary

Adds a time-trap spam guard to the shared ContactForm.astro (used on /contact-us), matching the protection already present in the development-services contact modal.

• Hidden form-rendered-at field stamped with a timestamp when the form becomes interactive.
• On submit, if the form is sent < 3s after init, it's treated as a bot: the submit is blocked (no POST to Formspree) and a "thank you" message is shown so the bot can't tell it was filtered.

Existing protection (_gotcha honeypot, XSS pattern check, email validation) is unchanged.