feat(auth) : protect admin login with turnstile

tests/security-boundaries.test.ts

@@ -33,4 +33,25 @@ describe("administrative security boundaries", () => {
       source.lastIndexOf("getAdminSession"),
     );
   });
+
+  it("enforces Cloudflare Turnstile on email sign-in", async () => {
+    const source = await readFile(
+      new URL("../lib/auth/server.ts", import.meta.url),
+      "utf8",
+    );
+    expect(source).toContain('provider: "cloudflare-turnstile"');
+    expect(source).toContain('secretKey: required("TURNSTILE_SECRET_KEY")');
+    expect(source).toContain('endpoints: ["/sign-in/email"]');
+  });
+
+  it("requires a Turnstile token before submitting administrator login", async () => {
+    const source = await readFile(
+      new URL("../components/admin/login-card.tsx", import.meta.url),
+      "utf8",
+    );
+    expect(source).toContain('headers: { "x-captcha-response": turnstileToken }');
+    expect(source).toContain("disabled={loading || !turnstileToken}");
+    expect(source).toContain('"expired-callback": () => setTurnstileToken(null)');
+    expect(source).toContain("resetTurnstile();");
+  });
 });