fix: protect public Auth flows from automated abuse (#1904)

* fix: add Turnstile to public auth flows

* test: isolate Turnstile auth tests

.env.example

@@ -67,6 +67,13 @@ RECEIPT_HUNT_COMPANY_IDS=
 # The button stays hidden until this is true.
 # NEXT_PUBLIC_GOOGLE_AUTH_ENABLED=true
 
+# Cloudflare Turnstile site key for Supabase Auth bot protection. This value is
+# public and is embedded in the browser bundle. Leave it unset until a widget
+# has been created for the deployment's exact hostnames. Deploy the site key
+# before enabling Turnstile with the matching SECRET in Supabase Auth, so the
+# existing login flow remains available throughout rollout.
+# NEXT_PUBLIC_TURNSTILE_SITE_KEY=
+
 # ── Optional: extension features (core runs without these) ─
 # AI features (document extraction + AI assistant). Three ways to provide a
 # backend; set one of them. AI_PROVIDER (bedrock|anthropic|openai-compatible)