fix(#622): the auth-config applier can no longer half-apply a secret-bearing feature

[TortoiseWolfe]

The bug

scripts/supabase/auth-config.json is committed, so it holds no secrets. But two of
the features it declares are broken or dangerous without one, and the Management API
takes the secret as a sibling field in the same PATCH:

declared field	needs	if applied without it
smtp_host, smtp_user, …	smtp_pass	custom SMTP with no password sends nothing — worse than the built-in fallback mailer
security_captcha_enabled	security_captcha_secret	every signup rejected

--apply sent the visible fields and omitted the secrets — so the command the drift
check recommends could leave production strictly worse than the drift it "fixed".

Not hypothetical: on 2026-08-07 the drift check told an operator to run exactly this
against a production project whose smtp_host was null. Details in #622.

The fix

Each secret is sourced from env, falling back to .env (nothing preloads dotenv for
this script, so a normal local shell would otherwise read every secret as absent).
When a secret is missing, that feature's fields are withheld entirely rather than
half-applied, with a message naming the harm. If everything gets withheld, exit 1.

TURNSTILE_SECRET is the name scripts/check-captcha.mjs already uses — one name per
secret. Run that script first; it validates against Cloudflare siteverify.

Verification

Against production, with TURNSTILE_SECRET unset:

Proposed changes (2):
  security_captcha_enabled   false      -> true
  security_captcha_provider  "hcaptcha" -> "turnstile"

  ⚠ CAPTCHA: WITHHELD — no security_captcha_secret found in TURNSTILE_SECRET or …
    Applying it anyway would mean: CAPTCHA enabled with no secret REJECTS EVERY SIGNUP.

✗ Every proposed change was withheld for a missing secret. Nothing applied.
exit 1

Nothing was changed. Before this PR that same invocation would have enabled Turnstile
with no secret.

Stated limitation: the attach path runs only under --apply, so it is exercised
only when a real secret exists — I did not fake one against production. It will be
verified when the Turnstile secret is restored (the "attaching …" line, plus the drift
check going green).

Closes #622