Create a public Visitor Pass application

This endpoint does not require an API key, but every request requires a fresh Cloudflare Turnstile token (turnstileToken) for action visitor-pass from an approved hostname. The server verifies it before any account creation, application processing, or email. Missing, invalid, expired, replayed, wrong-action, or wrong-hostname tokens return 400; verification outages or missing configuration return 503. The applicant must provide consent and a signature as a canonical base64 PNG data URL (data:image/png;base64,...), with at most 512 KiB of image data and 4 million pixels. The image must fully decode and be embeddable in the agreement PDF. Invalid signatures return 400 before an account or application is created.