docs: close turnstile roadmap items

README.md

@@ -42,6 +42,37 @@ docker run -p 8000:8000 vault-dash
 docker-compose up -d
 ```
 
+### Turnstile configuration
+
+Workspace creation on the public welcome page is protected by Cloudflare Turnstile.
+
+Local and test environments may use Cloudflare's published test keys:
+
+```bash
+TURNSTILE_SITE_KEY=1x00000000000000000000AA
+TURNSTILE_SECRET_KEY=1x0000000000000000000000000000000AA
+```
+
+Negative-path testing can use the always-fail/blocked test keys:
+
+```bash
+TURNSTILE_SITE_KEY=2x00000000000000000000AB
+TURNSTILE_SECRET_KEY=2x0000000000000000000000000000000AA
+```
+
+Production must provide real keys via environment variables:
+
+```bash
+TURNSTILE_SITE_KEY=...
+TURNSTILE_SECRET_KEY=...
+```
+
+In Forgejo deployment:
+- `vars.TURNSTILE_SITE_KEY` provides the public site key
+- `secrets.TURNSTILE_SECRET_KEY` provides the server-side secret key
+
+Browser tests run with `APP_ENV=test` and the Turnstile test keys.
+
 ## Architecture
 
 ```