Demo Config

The public settings the demo page cannot know until it asks.

Today that is one field: the Turnstile SITE KEY, which is public by definition (Cloudflare reads it out of the rendered page) and returned here rather than baked into the web bundle.

WHY AN ENDPOINT AT ALL, FOR A VALUE THAT NEVER CHANGES. It was a Vite build-time variable, VITE_TURNSTILE_SITE_KEY. It was set on the Railway web service, it was correct, and it never reached the bundle -- because apps/web/Dockerfile declares no matching ARG, so npm run build inside the image never saw it. Nothing failed. The dashboard said configured, CI stayed green (the web tests supply their own key), and the deployed page simply rendered no widget.

That is worse than it sounds, because the SERVER half was configured correctly: POST /demo/request had a secret, so it required a token, and the page had no way to produce one. Every real visitor would have been answered 403 "We could not verify you are human" on the last click of a form they had already filled in. The first person to find that would have been a warden.

So the page asks the API, and the API answers from the same credential store that decides whether the check runs at all (turnstile.load_site_key / load_secret). One fact, one place: they cannot disagree, and rotating the pair no longer needs a web rebuild.

Rate-limited on the availability budget rather than its own: it is one cheap read, fired once per page load, on the same visit that is about to fetch a grid.