fix(captcha): close human-verification loop end-to-end

Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.

inc/classes/class-aksrt-sms.php

@@ -296,10 +296,15 @@ class AKSRT_SMS {
             wp_send_json_error(['message' => __('手机号格式不正确', 'aksrt')]);
         }
 
-        // 人机验证钩子（对齐 zibll 的 man_machine_verification）
-        $captcha_result = apply_filters('aksrt_sms_captcha_verify', true, $phone);
-        if ($captcha_result !== true) {
-            wp_send_json_error(['message' => $captcha_result ?: __('人机验证失败', 'aksrt')]);
+        $scene = sanitize_key((string) ($_POST['scene'] ?? 'register'));
+        if (!array_key_exists($scene, function_exists('aksrt_captcha_scenes') ? aksrt_captcha_scenes() : [])) {
+            $scene = 'register';
+        }
+        if (function_exists('aksrt_require_captcha')) {
+            $captcha_result = aksrt_require_captcha($scene, wp_unslash($_POST));
+            if ($captcha_result !== true) {
+                wp_send_json_error(['message' => $captcha_result ?: __('人机验证失败', 'aksrt')]);
+            }
         }
 
         $result = $this->send_code($phone);