fix(captcha): close human-verification loop end-to-end

Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.

inc/classes/admin/class-aksrt-admin-user-controller-auth-phone-operations.php

@@ -181,6 +181,17 @@ trait AKSRT_Admin_User_Controller_Auth_Phone_Operations {
     public function auth_send_sms_code(WP_REST_Request $request): WP_REST_Response {
         $params = $this->get_json_params($request);
         $phone  = sanitize_text_field((string) ($params['phone'] ?? ''));
+        $scene  = sanitize_key((string) ($params['scene'] ?? 'register'));
+        if (!array_key_exists($scene, function_exists('aksrt_captcha_scenes') ? aksrt_captcha_scenes() : [])) {
+            $scene = 'register';
+        }
+
+        if (function_exists('aksrt_require_captcha')) {
+            $captcha_result = aksrt_require_captcha($scene, is_array($params) ? $params : []);
+            if ($captcha_result !== true) {
+                return $this->error((string) $captcha_result, 400);
+            }
+        }
 
         if (!class_exists('AKSRT_SMS')) {
             return $this->error('短信服务不可用');