fix(captcha): close human-verification loop end-to-end

Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.

assets/js/core/comments.js

@@ -232,9 +232,15 @@
 
             var replyInfo = document.getElementById('comment-reply-info');
             if (replyInfo) replyInfo.style.display = 'none';
-            // Reset captcha
-            var captchaImg = form.querySelector('.imagecaptcha img');
-            if (captchaImg) captchaImg.click();
+            // Reset captcha after successful submit
+            try {
+              var captchaScene = window.AKSRTCaptchaState &&
+                window.AKSRTCaptchaState.scenes &&
+                window.AKSRTCaptchaState.scenes.comment;
+              if (captchaScene && typeof captchaScene.reset === 'function') {
+                captchaScene.reset();
+              }
+            } catch (e) { /* ignore */ }
 
             // Wait time countdown
             if (json.wait_time && json.wait_time > 0) {
@@ -251,6 +257,14 @@
 
           if (json && json.code) {
             showToast(json.message || '评论提交失败', 'error');
+            try {
+              var failScene = window.AKSRTCaptchaState &&
+                window.AKSRTCaptchaState.scenes &&
+                window.AKSRTCaptchaState.scenes.comment;
+              if (failScene && typeof failScene.reset === 'function') {
+                failScene.reset();
+              }
+            } catch (e) { /* ignore */ }
             if (json.wait_time) startCountdown(json.wait_time);
             else setLoading(false);
             return;