- Turnstile validation only required when TURNSTILE_SECRET_KEY is set - Allows tests to run without CAPTCHA in test environment - Fixes matching-runs-audit test failures caused by missing turnstileToken - Update validators.js to conditionally require turnstileToken - Update auth.js controller to skip verification when not configured