fix(captcha): seal comment fallback and phone-register client loop

Gate preprocess_comment so native wp-comments-post cannot bypass captcha,
require verify+reset on phone register, and align UsersSignin status with
active provider.

inc/classes/class-aksrt-moderation.php

@@ -81,6 +81,24 @@ class AKSRT_Moderation {
      * Main moderation entry.
      */
     public function process(array $commentdata): array {
+
+        // 人机验证：覆盖 REST 与原生 wp-comments-post 两条提交合同（与审核开关无关）
+        if (function_exists('aksrt_require_captcha')) {
+            $payload = is_array($_POST ?? null) ? wp_unslash($_POST) : [];
+            if (isset($payload['captcha']) && is_array($payload['captcha'])) {
+                $payload = array_merge($payload, $payload['captcha']);
+            }
+            $captcha_result = aksrt_require_captcha('comment', $payload);
+            if ($captcha_result !== true) {
+                $msg = is_string($captcha_result) ? $captcha_result : __('人机验证失败', 'aksrt');
+                wp_die(
+                    esc_html($msg),
+                    esc_html__('评论提交失败', 'aksrt'),
+                    ['response' => 400, 'back_link' => true]
+                );
+            }
+        }
+
         $config = $this->get_config();
 
         if (empty($config['enabled'])) {