fix(frontend): stop infinite pagination admin-ajax 400 spam

Hardened list-page infinite scroll so it no longer auto-fires three
admin-ajax requests on first paint, returns machine-readable nonce
errors, localizes aksrtData earlier for core modules, and ignores
UI-only data-action clicks.

inc/classes/class-aksrt-admin.php

@@ -281,7 +281,11 @@ class AKSRT_Admin {
 
 
     public function ajax_load_more_posts(): void {
-        check_ajax_referer('aksrt_public_nonce', 'nonce');
+        $nonce = isset($_POST['nonce']) ? (string) wp_unslash($_POST['nonce']) : '';
+        if ($nonce === '' || !wp_verify_nonce($nonce, 'aksrt_public_nonce')) {
+            wp_send_json_error(['message' => __('安全验证失败', 'aksrt')], 403);
+        }
+
         $page = max(1, (int) ($_POST['page'] ?? 1));
         $query_vars = json_decode(wp_unslash((string) ($_POST['query_vars'] ?? '{}')), true);
         $render_config = json_decode(wp_unslash((string) ($_POST['render_config'] ?? '{}')), true);
@@ -300,13 +304,19 @@ class AKSRT_Admin {
             $render_config = array_merge($resolved, $render_config);
         }
         $query_vars['paged'] = $page;
+        if (empty($query_vars['post_status'])) {
+            $query_vars['post_status'] = 'publish';
+        }
+        if (empty($query_vars['post_type'])) {
+            $query_vars['post_type'] = 'post';
+        }
 
         $query = new WP_Query($query_vars);
         ob_start();
         if (function_exists('aksrt_render_post_list')) {
             aksrt_render_post_list($query, $render_config, true);
         }
-        $html = ob_get_clean();
+        $html = (string) ob_get_clean();
 
         wp_send_json_success([
             'html'     => $html,
@@ -316,11 +326,15 @@ class AKSRT_Admin {
     }
 
     public function ajax_load_more_comments(): void {
-        check_ajax_referer('aksrt_public_nonce', 'nonce');
+        $nonce = isset($_POST['nonce']) ? (string) wp_unslash($_POST['nonce']) : '';
+        if ($nonce === '' || !wp_verify_nonce($nonce, 'aksrt_public_nonce')) {
+            wp_send_json_error(['message' => __('安全验证失败', 'aksrt')], 403);
+        }
+
         $post_id = absint($_POST['post_id'] ?? 0);
         $page = max(1, (int) ($_POST['page'] ?? 1));
         if ($post_id <= 0) {
-            wp_send_json_error(['message' => __('无效的文章 ID', 'aksrt')]);
+            wp_send_json_error(['message' => __('无效的文章 ID', 'aksrt')], 400);
         }
 
         $order = sanitize_key((string) ($_POST['comment_order'] ?? $_POST['order'] ?? 'newest'));

inc/classes/scripts-traits/trait-aksrt-scripts-part-1b.php

@@ -798,7 +798,8 @@ trait AKSRT_Scripts_Part_1b {
         foreach ($core_modules as $handle => $file) {
             $path = get_template_directory() . '/assets/js/core/' . $file;
             if (file_exists($path)) {
-                $deps = ['aksrt-rehydrate'];
+                // Depend on aksrt-runtime so window.aksrtData (localized below) is available.
+                $deps = ['aksrt-rehydrate', 'aksrt-runtime'];
                 if ($handle === 'aksrt-core-slider') {
                     $deps = array_merge($deps, $needs_swiper ? ['aksrt-swiper'] : []);
                 }
@@ -1183,7 +1184,12 @@ trait AKSRT_Scripts_Part_1b {
         $runtime_routes = $this->resolve_frontend_routes();
 
         // 数据注入 - 全站统一消费 window.aksrtData
-        wp_localize_script('aksrt-script', 'aksrtData', [
+        // Attach to aksrt-runtime (loaded before all core modules) so ajaxUrl/nonce
+        // exist before pagination/search/article handlers run.
+        $aksrt_data_handle = wp_script_is('aksrt-runtime', 'registered') || wp_script_is('aksrt-runtime', 'enqueued')
+            ? 'aksrt-runtime'
+            : 'aksrt-script';
+        wp_localize_script($aksrt_data_handle, 'aksrtData', [
             'ajaxUrl'               => admin_url('admin-ajax.php'),
             'nonce'                 => wp_create_nonce('aksrt_public_nonce'),
             'restNonce'             => wp_create_nonce('wp_rest'),