Add turnstile token to subscription

[cocomarine]

Part of https://github.com/RaspberryPiFoundation/digital-editor-issues/issues/1353
(frontend PR: https://github.com/RaspberryPiFoundation/editor-standalone/pull/859)

Notes

• Generated turnstile secret keys for staging and prod in Cloudflare and added them as CLOUDFLARE_TURNSTILE_SECRET_KEY to config var using terraform
• Updated .env.example to reflect this

[github-actions]

Test coverage

89.41% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/25550741178

[Copilot]

Pull request overview

Adds Cloudflare Turnstile bot-protection to the subscriptions endpoint by accepting a turnstile_token in the request and verifying it server-side (with fail-open behavior on upstream/network errors), supporting issue RaspberryPiFoundation/digital-editor-issues#1353.

Changes:

• Add turnstile_token to subscription request payloads and add request specs covering success/failure/fail-open scenarios.
• Add Turnstile verification before_action to Api::SubscriptionsController#create using Cloudflare’s siteverify endpoint.
• Add application configuration and example env var for the Turnstile secret key and enablement flag.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
spec/requests/api/subscriptions_spec.rb	Extends subscription request payload and adds Turnstile integration request specs (failure + fail-open cases).
app/controllers/api/subscriptions_controller.rb	Enforces Turnstile verification (when enabled) before processing subscription creation.
config/application.rb	Adds config.x.cloudflare_turnstile secret + enablement derived from env.
.env.example	Documents CLOUDFLARE_TURNSTILE_SECRET_KEY for local/testing setup.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zetter-rpf]

This is great

My only suggestion is that if the turnstile checking was in it's own class rather than a method in the controller it might be easier to test independently of the controller (and then stub in the controller tests). I saw you used shared examples in the spec to help remove some of this duplication which is good, but can make the tests files harder to work with. Up to you if you think this change is worth it.