feat(users): govern profiles and access

Normalize fixed profile fields, profile actions, and the five-column capability matrix for comments, uploads, and downloads.

src/Auth/Moderation.php

@@ -81,6 +81,15 @@ class Moderation {
      */
     public function process(array $commentdata): array {
 
+        $actor = get_current_user_id();
+        if (!function_exists('aksrt_user_can') || !aksrt_user_can('comment_add', $actor, (int) ($commentdata['comment_post_ID'] ?? 0))) {
+            wp_die(
+                esc_html__('当前账号没有发表评论的权限。', 'aksrt'),
+                esc_html__('评论提交失败', 'aksrt'),
+                ['response' => $actor > 0 ? 403 : 401, 'back_link' => true]
+            );
+        }
+
         // 人机验证：覆盖 REST 与原生 wp-comments-post 两条提交合同（与审核开关无关）
         if (function_exists('aksrt_require_captcha')) {
             $payload = is_array($_POST ?? null) ? wp_unslash($_POST) : [];