fix(captcha): wire scene switches and rename menu to 人机验证

- Admin: 登录权限 → 人机验证; 停用场景 → 启用场景 (opt-in)
- Normalize enabled_scenarios with legacy disabled_scenarios BC
- Sign-in: never soft-bypass captcha; cancel unlocks button
- Captcha JS: cancel path finishes pending callback as false

assets/admin/src/pages/permissions/CommentPermissions.vue

@@ -115,12 +115,16 @@ async function load() {
     const comment = commentData?.data ?? commentData ?? {}
     const captcha = captchaRes?.data ?? captchaRes ?? {}
     const moderation = moderationRes?.data ?? moderationRes ?? {}
+    const enabledScenarios = Array.isArray(captcha.enabled_scenarios) ? captcha.enabled_scenarios : null
     const disabledScenarios = Array.isArray(captcha.disabled_scenarios) ? captcha.disabled_scenarios : []
+    const commentSceneOn = enabledScenarios
+      ? enabledScenarios.includes('comment')
+      : !disabledScenarios.includes('comment')
 
     form.comment_require_login = !!comment.comment_require_login
     form.comment_allow_reply = comment.comment_allow_reply !== false
 
-    status.commentCaptchaEnabled = !!captcha.enabled && !!captcha.active_provider && !disabledScenarios.includes('comment')
+    status.commentCaptchaEnabled = !!captcha.enabled && !!captcha.active_provider && commentSceneOn
     status.moderationEnabled = !!moderation.enabled
     status.rateLimitEnabled = !!moderation.rate_limit_enabled
     status.keywordRuleCount = splitKeywords(moderation.blocked_keywords).length

assets/admin/src/pages/permissions/DownloadPermissions.vue

@@ -54,7 +54,7 @@
           <n-form-item label="下载启用验证码">
             <n-switch v-model:value="form.download_captcha" />
             <template #feedback>
-              <span class="aksrt-hint-text">具体验证码服务商与场景白名单仍在“登录权限”页维护。</span>
+              <span class="aksrt-hint-text">具体验证码服务商与场景白名单仍在「人机验证」页维护。</span>
             </template>
           </n-form-item>
         </n-form>

assets/admin/src/pages/users/UsersSignin.vue

@@ -227,9 +227,16 @@ async function load() {
     const captchaData = extractData(captchaRes)
     const dailySignin = creditData.daily_signin || {}
     const inviteReward = creditData.invite_reward || {}
+    const enabledScenarios = Array.isArray(captchaData.enabled_scenarios)
+      ? captchaData.enabled_scenarios
+      : null
     const disabledScenarios = Array.isArray(captchaData.disabled_scenarios)
       ? captchaData.disabled_scenarios
       : []
+    const sceneOn = (key) => {
+      if (enabledScenarios) return enabledScenarios.includes(key)
+      return !disabledScenarios.includes(key)
+    }
 
     creditSnapshot.value = creditData
     authSnapshot.value = authData
@@ -249,8 +256,8 @@ async function load() {
     form.invite_register_field = authData.invite_register_field || 'optional'
     form.invite_reject_invalid = authData.invite_reject_invalid !== false
 
-    captchaSummary.register = !!captchaData.enabled && !!captchaData.active_provider && !disabledScenarios.includes('register')
-    captchaSummary.signin = !!captchaData.enabled && !!captchaData.active_provider && !disabledScenarios.includes('signin')
+    captchaSummary.register = !!captchaData.enabled && !!captchaData.active_provider && sceneOn('register')
+    captchaSummary.signin = !!captchaData.enabled && !!captchaData.active_provider && sceneOn('signin')
   } catch (error) {
     message.error(error.message || '加载签到奖励配置失败')
   } finally {