fix(captcha): close human-verification loop end-to-end

Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.

assets/admin/src/schema/sections/permissions/index.js

@@ -289,29 +289,15 @@ export const permissionsSchemas = {
   },
 
   /**
-   * Download permissions
+   * Download permissions — live UI is DownloadPermissions.vue via cms_features.
+   * Keep empty schema so SchemaPage cannot mis-write aksrt_settings.
    */
   download: {
     key: 'permissions.download',
     title: '下载权限',
     icon: 'fas fa-download',
-    description: '控制资源下载的权限和限制。',
-    defaults: {
-      download_require_login: false,
-      download_daily_limit: 0,
-      download_captcha: false,
-    },
-    groups: [
-      {
-        key: 'basic',
-        title: '下载设置',
-        icon: 'fas fa-cog',
-        fields: [
-          { key: 'download_require_login', label: '需登录下载', type: 'switch' },
-          { key: 'download_daily_limit', label: '每日下载限制', type: 'number', min: 0, help: '0 表示不限制' },
-          { key: 'download_captcha', label: '下载验证码', type: 'switch', help: '下载前需要验证码' },
-        ],
-      },
-    ],
+    description: '下载门槛由 DownloadPermissions 页维护（cms_features）；人机验证服务商在登录权限页。',
+    defaults: {},
+    groups: [],
   },
 };