feat(users): govern profiles and access

Normalize fixed profile fields, profile actions, and the five-column capability matrix for comments, uploads, and downloads.

templates/pages/page-submit.php

@@ -68,9 +68,9 @@ if (file_exists($js)) {
 			true
 		);
 	}
-	if (!empty($ctx['can_upload_img']) || !empty($ctx['can_cover_image']) || !empty($ctx['can_cover_slide'])) {
-		wp_enqueue_media();
-	}
+	$attachment_settings = class_exists('\\AKSRT\\Settings\\Settings') ? \AKSRT\Settings\Settings::get_all() : [];
+	$submit_image_max_size = max(1, min(20, (int) ($attachment_settings['submit_image_max_size'] ?? 5))) * MB_IN_BYTES;
+	$resource_max_size = max(1, min(200, (int) ($attachment_settings['resource_max_size'] ?? 50))) * MB_IN_BYTES;
 
 	wp_localize_script('aksrt-front-submit', 'aksrtSubmitData', [
 		'ajaxUrl'   => admin_url('admin-ajax.php'),
@@ -83,6 +83,16 @@ if (file_exists($js)) {
 			'summary'   => !empty($ctx['ai_available']),
 			'tags'      => !empty($ctx['ai_available']),
 		],
+		'uploads'   => [
+			'image' => !empty($ctx['can_upload_img']) ? [
+				'url'     => esc_url_raw(rest_url('aksrt/v1/front-submit/upload/image')),
+				'maxSize' => $submit_image_max_size,
+			] : null,
+			'resource' => !empty($ctx['can_upload_file']) ? [
+				'url'     => esc_url_raw(rest_url('aksrt/v1/front-submit/upload/resource')),
+				'maxSize' => $resource_max_size,
+			] : null,
+		],
 		'i18n'      => [
 			'confirmLeave'  => __('你有未保存的更改，确定要离开吗？', 'aksrt'),
 			'saving'        => __('保存中...', 'aksrt'),