fix(captcha): close human-verification loop end-to-end

Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.

inc/classes/class-aksrt-signin.php

@@ -95,15 +95,15 @@ class AKSRT_Signin {
         }
 
         // 人机验证（若启用）
-        if (function_exists('aksrt_is_captcha_enabled_for') && aksrt_is_captcha_enabled_for('signin')) {
-            $body = $request->get_json_params();
-            $cap_payload = isset($body['captcha']) && is_array($body['captcha']) ? $body['captcha'] : [];
-            if (function_exists('aksrt_verify_captcha')) {
-                $verify = aksrt_verify_captcha($cap_payload);
-                if ($verify !== true) {
-                    $msg = is_string($verify) ? $verify : __('人机验证失败', 'aksrt');
-                    return new WP_Error('aksrt_captcha_failed', $msg, ['status' => 400]);
-                }
+        if (function_exists('aksrt_require_captcha')) {
+            $body        = $request->get_json_params();
+            $cap_payload = is_array($body) && isset($body['captcha']) && is_array($body['captcha'])
+                ? $body['captcha']
+                : (is_array($body) ? $body : []);
+            $verify = aksrt_require_captcha('signin', $cap_payload);
+            if ($verify !== true) {
+                $msg = is_string($verify) ? $verify : __('人机验证失败', 'aksrt');
+                return new WP_Error('aksrt_captcha_failed', $msg, ['status' => 400]);
             }
         }