feat(SEC-001): protect workspace bootstrap with turnstile

.forgejo/workflows/deploy.yaml

@@ -47,7 +47,14 @@ jobs:
           pip install nicegui fastapi uvicorn yfinance polars pandas pydantic pyyaml
           pip list
       - name: Run tests
-        run: pytest tests/test_pricing.py tests/test_strategies.py tests/test_portfolio.py -v --tb=short
+        run: |
+          pytest \
+            tests/test_pricing.py \
+            tests/test_strategies.py \
+            tests/test_portfolio.py \
+            tests/test_turnstile.py \
+            tests/test_workspace.py \
+            -v --tb=short
 
   type-check:
     runs-on: [linux, docker]
@@ -127,6 +134,8 @@ jobs:
       APP_ENV: production
       APP_NAME: Vault Dashboard
       APP_PORT: "8000"
+      TURNSTILE_SITE_KEY: ${{ vars.TURNSTILE_SITE_KEY }}
+      TURNSTILE_SECRET_KEY: ${{ secrets.TURNSTILE_SECRET_KEY }}
     steps:
       - uses: actions/checkout@v4