Move the enablement logic out of `defaults/main.yml` and into a derived
`matrix_continuwuity_recaptcha_enabled` flag in `vars/main.yml`, since it
is computed (not user-facing) state. Continuwuity has no native
enable-captcha toggle, so presence of both keys is what enables the flow.

Replace the partial-config validation with a single consistency check
that fails only when exactly one of the two keys is set, and keep both
keys empty by default so nothing is rendered when ReCAPTCHA is unused.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>