DoorStepTech security-focused update

Files changed:
- index.html
- api/appointment.js

Required Vercel env reminder:
ALLOWED_ORIGINS=https://www.doorstep-tech.com,https://doorstep-tech.com

Keep these only in Vercel Environment Variables, never in index.html:
RESEND_API_KEY
TWILIO_AUTH_TOKEN
TWILIO_ACCOUNT_SID
APPOINTMENT_WEBHOOK_SECRET
TURNSTILE_SECRET_KEY

After env changes, redeploy in Vercel.