fix(captcha): close human-verification loop end-to-end

Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.

assets/js/cms-download.js

@@ -231,8 +231,11 @@
 		const state = window.AKSRTCaptchaState;
 		const scene = state && state.scenes && state.scenes.download;
 		if (!scene || typeof scene.verify !== 'function') {
-			// captcha 组件还未就绪，直接发，由后端兜底报错
-			callback();
+			// captcha 组件未就绪：不直发，避免绕过服务端门槛
+			if (window.console && console.warn) {
+				console.warn('[AKSRT] download captcha not ready');
+			}
+			alert(tt('captcha_loading', '验证码组件加载中，请稍候再试'));
 			return;
 		}
 		scene.verify(function () { callback(); });