Connect the contact form

The form at /contact is the first thing on this site that receives anything. Everything else here only hands pages out.

It is built and deployed. It does not deliver yet, because the mailbox and the API key do not exist. Until they do it returns a plain "this form is not connected yet" — deliberately, because a form that thanks someone for a message nobody receives is worse than one that admits it is not ready.

Still to do, and it is not code

1. Create prefect@scofti.com as a forwarding address at Porkbun.
2. Open a free account at Resend.
3. Add scofti.com as a sending domain and put Resend's DKIM and SPF records into Porkbun DNS. Two things to watch: leave the existing MX records (fwd1/fwd2.porkbun.com) alone — that is the forwarding, and Resend does not touch it — and if Porkbun already publishes an SPF record, merge Resend's into it rather than adding a second. Two SPF records break both.
4. Create an API key.
5. Put RESEND_API_KEY and CONTACT_TO in .env.local, and add both in Vercel → Settings → Environment Variables.

The address is never rendered on any page — it lives only in CONTACT_TO — so it is not there to be scraped.

How it is built

The message passes through and is not stored: read off the request, handed to Resend, dropped. Nothing logs a name, an address or a message body, because an error log full of people's messages is a store by another name.

Spam defence is a honeypot field and one message per address per minute, held in memory. No reCAPTCHA — it is Google tracking, and it would sit one click from a page promising the opposite. The rate limit resets on redeploy and is not shared between instances, which makes it a speed bump rather than a guarantee. That trade is deliberate: the alternative is keeping a store of visitor IP addresses, which is a worse thing to own than the spam it would stop.

The privacy page already describes this flow, so the two have to stay true to each other. Changing what this route does means changing that page in the same commit.