feat: scale marketing to 1 replica, add notification + turnstile secrets

Single replica required for in-memory pending leads Map used by SMS
double-opt-in flow. ExternalSecret adds Resend, Twilio, and Turnstile
keys to the marketing pod environment.

servers/legion/k8s/neuron-technologies/marketing/deployment.yaml

@@ -7,7 +7,7 @@ metadata:
     app: neuron-marketing
     env: prod
 spec:
-  replicas: 2
+  replicas: 1
   selector:
     matchLabels:
       app: neuron-marketing

servers/legion/k8s/neuron-technologies/marketing/externalsecret.yaml

@@ -6,6 +6,18 @@
 #     stripe_price_professional="price_..." \
 #     stripe_price_founding="price_..." \
 #     next_public_stripe_publishable_key="pk_live_..."
+#
+# Notification keys (Resend + Twilio) sourced from notifications path:
+#   vault kv put secret/neuron-technologies/notifications \
+#     resend_api_key="re_..." \
+#     twilio_account_sid="AC..." \
+#     twilio_auth_token="..." \
+#     twilio_from_number="+1..."
+#
+# Turnstile (Cloudflare):
+#   vault kv patch secret/neuron-technologies/marketing \
+#     turnstile_secret_key="..." \
+#     next_public_turnstile_site_key="..."
 
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
@@ -53,3 +65,30 @@ spec:
       remoteRef:
         key: secret/data/neuron-technologies/marketing
         property: license_admin_token
+    # Notification — Resend (email blasts + confirmations)
+    - secretKey: RESEND_API_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/notifications
+        property: resend_api_key
+    # Notification — Twilio (SMS blasts + confirmations)
+    - secretKey: TWILIO_ACCOUNT_SID
+      remoteRef:
+        key: secret/data/neuron-technologies/notifications
+        property: twilio_account_sid
+    - secretKey: TWILIO_AUTH_TOKEN
+      remoteRef:
+        key: secret/data/neuron-technologies/notifications
+        property: twilio_auth_token
+    - secretKey: TWILIO_FROM_NUMBER
+      remoteRef:
+        key: secret/data/neuron-technologies/notifications
+        property: twilio_from_number
+    # Cloudflare Turnstile (waitlist captcha)
+    - secretKey: TURNSTILE_SECRET_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/marketing
+        property: turnstile_secret_key
+    - secretKey: NEXT_PUBLIC_TURNSTILE_SITE_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/marketing
+        property: next_public_turnstile_site_key