docs(env): clarify captcha provider setup and key handling

Document that CAPTCHA_PROVIDER accepts a provider name (e.g. turnstile)
and spell out that the site key is public while the secret must stay on
the host / in CI and never be committed.

.env.example

@@ -94,10 +94,14 @@ CLOUDFLARE_AUTO_BLOCK_ENABLED=true
 CLOUDFLARE_API_BASE_URL=https://api.cloudflare.com/client/v4
 
 # --- CAPTCHA (env fallback; admin settings win when set) ---
-# Enable Turnstile on register/login/forgot/resend without touching the DB.
+# Enable a captcha on register/login/forgot/resend without touching the DB.
-# "none" (default), "turnstile", "recaptcha" or "hcaptcha".
+# "none" (default), "turnstile", "recaptcha" or "hcaptcha". Example:
+#   CAPTCHA_PROVIDER=turnstile
 CAPTCHA_PROVIDER=
-# Cloudflare Turnstile keys from https://dash.cloudflare.com/turnstile
+# Provider keys. The SITE key is public (it ships to every browser), the
+# SECRET is server-only and must never be committed — set it on the host or as
+# a masked CI/CD variable. Cloudflare Turnstile keys:
+# https://dash.cloudflare.com/turnstile
 TURNSTILE_SITE_KEY=
 TURNSTILE_SECRET_KEY=