JS validation — messages under inputs

Page role: Client-side validation only (form has novalidate). On submit, JS checks each field, writes messages under inputs, and sets setCustomValidity(...) so :invalid is also true when rules fail.

Rules: name ≥ 3 chars; email must contain @ and .; phone must match /^\+\d{10,15}$/; promo must be exactly 10 uppercase letters.

Bot scoring: autofill usually fails the promo (and sometimes phone) rule → under-input text appears and :invalid remains → typically FAIL for the form path. If all rules somehow pass, a thank-you banner appears → PASS.