fix(captcha): close human-verification loop end-to-end

Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.

inc/classes/class-aksrt-comment-actions.php

@@ -227,6 +227,17 @@ class AKSRT_Comment_Actions {
             ], 403);
         }
 
+        if (function_exists('aksrt_require_captcha')) {
+            $captcha_result = aksrt_require_captcha('comment', $params);
+            if ($captcha_result !== true) {
+                return new \WP_REST_Response([
+                    'success' => false,
+                    'code'    => 'captcha_failed',
+                    'message' => (string) $captcha_result,
+                ], 400);
+            }
+        }
+
         $user = wp_get_current_user();
         $commentdata = [
             'comment_post_ID'      => $post_id,
@@ -263,11 +274,6 @@ class AKSRT_Comment_Actions {
                 $_POST[$k] = $params[$k];
             }
         }
-        foreach ($params as $k => $v) {
-            if (is_string($k) && (str_contains($k, 'captcha') || str_starts_with($k, 'g-recaptcha') || str_starts_with($k, 'cf-turnstile') || str_starts_with($k, 'h-captcha'))) {
-                $_POST[$k] = $v;
-            }
-        }
 
         $comment_id = wp_new_comment(wp_slash($commentdata), true);
         if (is_wp_error($comment_id)) {