fix(captcha): close human-verification loop end-to-end

Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.

assets/js/sign-register.js

@@ -81,11 +81,12 @@
     // 收集人机验证字段
     const form = btn.closest('form')
     const captchaData = collectCaptchaFields(form)
+    const scene = btn.dataset.aksrtSmsScene || 'register'
 
     fetch(REST_BASE + '/auth/send-sms-code', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ phone, ...captchaData }),
+      body: JSON.stringify({ phone, scene, ...captchaData }),
     })
       .then(r => r.json().then(data => ({ ok: r.ok, data })))
       .then(({ ok, data }) => {
@@ -97,6 +98,12 @@
         } else {
           const msg = (data.data && data.data.message) || data.message || '发送失败'
           showToast(msg, 'error')
+          try {
+            const captchaState = window.AKSRTCaptchaState
+            if (captchaState && captchaState.scenes && captchaState.scenes[scene]) {
+              captchaState.scenes[scene].reset()
+            }
+          } catch (e) { /* ignore */ }
           const remaining = data.data && data.data.remaining_time
           if (remaining && remaining > 0) {
             sessionStorage.setItem(COUNTDOWN_KEY, String(Date.now() + remaining * 1000))
@@ -265,33 +272,46 @@
       body = { phone, password }
     }
 
-    fetch(REST_BASE + endpoint, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(body),
-    })
-      .then(r => r.json().then(data => ({ ok: r.ok, data })))
-      .then(({ ok, data }) => {
-        if (ok && data.success) {
-          showToast('登录成功', 'success')
-          setTimeout(() => {
-            window.location.href = data.data?.redirect || '/'
-          }, 500)
-        } else {
-          showToast(data.message || '登录失败', 'error')
+    const captchaState = window.AKSRTCaptchaState
+    const doLogin = () => {
+      const captchaData = collectCaptchaFields(form)
+      fetch(REST_BASE + endpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ ...body, ...captchaData }),
+      })
+        .then(r => r.json().then(data => ({ ok: r.ok, data })))
+        .then(({ ok, data }) => {
+          if (ok && data.success) {
+            showToast('登录成功', 'success')
+            setTimeout(() => {
+              window.location.href = data.data?.redirect || '/'
+            }, 500)
+          } else {
+            showToast(data.message || '登录失败', 'error')
+            if (captchaState && captchaState.scenes && captchaState.scenes.login) {
+              captchaState.scenes.login.reset()
+            }
+            if (submitBtn) {
+              submitBtn.disabled = false
+              submitBtn.textContent = '登录'
+            }
+          }
+        })
+        .catch(() => {
+          showToast('网络错误', 'error')
           if (submitBtn) {
             submitBtn.disabled = false
             submitBtn.textContent = '登录'
           }
-        }
-      })
-      .catch(() => {
-        showToast('网络错误', 'error')
-        if (submitBtn) {
-          submitBtn.disabled = false
-          submitBtn.textContent = '登录'
-        }
-      })
+        })
+    }
+
+    if (captchaState && captchaState.scenes && captchaState.scenes.login) {
+      captchaState.scenes.login.verify(doLogin)
+    } else {
+      doLogin()
+    }
   }
 
   /* =================================================================