feat(scheduling): pluggable captcha (Turnstile) on public booking

infrastructure/docker-compose/docker-compose.yml

@@ -590,6 +590,9 @@ services:
       DEZKY_TRAEFIK: "1"
       # How nitro reaches platform-api inside the docker network.
       PLATFORM_API_INTERNAL_URL: http://platform-api:3001
+      # Optional Cloudflare Turnstile site-key — when set, the booking form
+      # renders a captcha widget. Empty by default (no widget).
+      NUXT_PUBLIC_TURNSTILE_SITE_KEY: ${NUXT_PUBLIC_TURNSTILE_SITE_KEY:-}
     volumes:
       - ../../apps/booking:/app
       - booking_node_modules:/app/node_modules
@@ -686,6 +689,9 @@ services:
       SCHEDULING_CREDENTIAL_KEY: ${SCHEDULING_CREDENTIAL_KEY}
       BOOKING_PUBLIC_URL: ${BOOKING_PUBLIC_URL:-https://booking.dezky.local}
       MEET_PUBLIC_URL: ${MEET_PUBLIC_URL:-https://meet.dezky.local}
+      # Optional Cloudflare Turnstile secret. When set, the public booking holds
+      # and bookings endpoints verify the visitor's captcha token; unset = no-op.
+      TURNSTILE_SECRET: ${TURNSTILE_SECRET:-}
     volumes:
       - ../../services/platform-api:/app
       - platform_api_node_modules:/app/node_modules