Add turnstile token to subscription

[cocomarine]

Part of https://github.com/RaspberryPiFoundation/digital-editor-issues/issues/1353
(frontend PR: https://github.com/RaspberryPiFoundation/editor-standalone/pull/859)

Notes

• Generated turnstile secret keys for staging and prod in Cloudflare and added them as CLOUDFLARE_TURNSTILE_SECRET_KEY to config var using terraform
• Updated .env.example to reflect this

[github-actions]

Test coverage

89.84% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/25504867221

[Copilot]

Pull request overview

Adds Cloudflare Turnstile bot-protection to the subscriptions endpoint by accepting a turnstile_token in the request and verifying it server-side (with fail-open behavior on upstream/network errors), supporting issue RaspberryPiFoundation/digital-editor-issues#1353.

Changes:

• Add turnstile_token to subscription request payloads and add request specs covering success/failure/fail-open scenarios.
• Add Turnstile verification before_action to Api::SubscriptionsController#create using Cloudflare’s siteverify endpoint.
• Add application configuration and example env var for the Turnstile secret key and enablement flag.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
spec/requests/api/subscriptions_spec.rb	Extends subscription request payload and adds Turnstile integration request specs (failure + fail-open cases).
app/controllers/api/subscriptions_controller.rb	Enforces Turnstile verification (when enabled) before processing subscription creation.
config/application.rb	Adds config.x.cloudflare_turnstile secret + enablement derived from env.
.env.example	Documents CLOUDFLARE_TURNSTILE_SECRET_KEY for local/testing setup.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.