feat(auth): 添加 Turnstile 注册防护

apps/aether-gateway/src/state/app.rs

@@ -2,6 +2,7 @@ use std::collections::HashMap;
 use std::sync::atomic::AtomicU64;
 use std::sync::Arc;
 use std::sync::Mutex as StdMutex;
+use std::time::Duration;
 
 use aether_runtime::ConcurrencyGate;
 use aether_runtime_state::{RuntimeSemaphore, RuntimeState};
@@ -76,6 +77,10 @@ pub struct AppState {
     pub(crate) admin_monitoring_error_stats_reset_at: Arc<StdMutex<Option<u64>>>,
     pub(crate) provider_delete_tasks: Arc<StdMutex<HashMap<String, LocalProviderDeleteTaskState>>>,
     #[cfg(test)]
+    pub(crate) turnstile_siteverify_url_override: Option<String>,
+    #[cfg(test)]
+    pub(crate) turnstile_siteverify_timeout_override: Option<Duration>,
+    #[cfg(test)]
     pub(crate) provider_oauth_state_store: Option<Arc<StdMutex<HashMap<String, String>>>>,
     #[cfg(test)]
     pub(crate) provider_oauth_device_session_store: Option<Arc<StdMutex<HashMap<String, String>>>>,

apps/aether-gateway/src/state/core.rs

@@ -258,6 +258,10 @@ impl AppState {
             admin_monitoring_error_stats_reset_at: Arc::new(StdMutex::new(None)),
             provider_delete_tasks: Arc::new(StdMutex::new(HashMap::new())),
             #[cfg(test)]
+            turnstile_siteverify_url_override: None,
+            #[cfg(test)]
+            turnstile_siteverify_timeout_override: None,
+            #[cfg(test)]
             provider_oauth_state_store: None,
             #[cfg(test)]
             provider_oauth_device_session_store: Some(Arc::new(StdMutex::new(HashMap::new()))),

apps/aether-gateway/src/state/testing.rs

@@ -21,6 +21,16 @@ impl AppState {
         self
     }
 
+    pub(crate) fn with_turnstile_siteverify_url_for_tests(mut self, url: &str) -> Self {
+        self.turnstile_siteverify_url_override = Some(url.trim().to_string());
+        self
+    }
+
+    pub(crate) fn with_turnstile_siteverify_timeout_for_tests(mut self, timeout: Duration) -> Self {
+        self.turnstile_siteverify_timeout_override = Some(timeout);
+        self
+    }
+
     pub(crate) fn with_tunnel_identity_for_tests(
         mut self,
         instance_id: &str,