feat(captcha): 打通人机验证 11 个场景的前后端完整链路

- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝
- 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名
- challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制
- 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费
- 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿
- 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码
- 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射
- 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config
- 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness

assets/js/front-submit.js

@@ -196,10 +196,20 @@
 
     submit: function (btn, action) {
       var self = this;
-      if (action !== 'posts_draft' && !this.requestCaptcha(function () {
-        self.submit(btn, action);
-      })) {
-        return;
+      if (action !== 'posts_draft') {
+        var captcha = window.AKSRTCaptcha;
+        if (captcha && !btn.dataset.aksrtCaptchaReady) {
+          captcha.run('front_submit', this.form).then(function (payload) {
+            if (payload === null) return;
+            btn.dataset.aksrtCaptchaReady = '1';
+            self.submit(btn, action);
+          }).catch(function () {
+            captcha.reset('front_submit', self.form);
+            notyf(i18n.error || '人机验证失败，请重试', 'danger');
+          });
+          return;
+        }
+        delete btn.dataset.aksrtCaptchaReady;
       }
       this.isSubmitting = true;
       var toastId = action === 'posts_draft'
@@ -292,28 +302,14 @@
           btn.disabled = false;
           btn.innerHTML = original;
           self.isSubmitting = false;
+        })
+        .finally(function () {
+          if (action !== 'posts_draft' && window.AKSRTCaptcha) {
+            window.AKSRTCaptcha.reset('front_submit', self.form);
+          }
         });
     },
 
-    requestCaptcha: function (onVerified) {
-      var verified = this.form.querySelector('input[name="captcha_verified"]');
-      if (verified && verified.value === '1') {
-        return true;
-      }
-      var captcha = window.AKSRTCaptchaState &&
-        window.AKSRTCaptchaState.scenes &&
-        window.AKSRTCaptchaState.scenes.front_submit;
-      if (!captcha || typeof captcha.verify !== 'function') {
-        return true;
-      }
-      captcha.verify(function (passed) {
-        if (passed) {
-          onVerified();
-        }
-      });
-      return false;
-    },
-
     bindDraftDelete: function () {
       document.addEventListener('click', function (e) {
         var btn = e.target.closest('.aksrt-submit-drafts__delete');