/**
 * Cloudflare Turnstile site key, resolved server-side.
 *
 * Read at request time and passed down to the auth forms as a prop (the same
 * pattern `googleEnabled` uses) rather than referenced inside a client
 * component. `NEXT_PUBLIC_*` values referenced in client code are inlined at
 * BUILD time, which would bake the key into the Docker image and require a
 * rebuild to rotate it; reading it here keeps it a runtime concern.
 *
 * Null when unset — the forms then render without a challenge. The server-side
 * enforcement in `lib/auth/auth.ts` is keyed off TURNSTILE_SECRET_KEY, which is
 * mandatory in production.
 */
export function getTurnstileSiteKey(): string | null {
  return process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY?.trim() || null;
}