feat(captcha): 打通人机验证 11 个场景的前后端完整链路

- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝
- 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名
- challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制
- 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费
- 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿
- 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码
- 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射
- 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config
- 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness

assets/js/signin.js

@@ -101,60 +101,14 @@
       return document.querySelector('[data-signin-captcha]');
     }
 
-    function collectCaptcha() {
-      var mount = captchaMount();
-      if (!mount) return {};
-      var payload = {};
-      var keys = [
-        'captcha_verified', 'cf_turnstile_response',
-        'tencent_ticket', 'tencent_randstr', 'tencent_sid',
-        'geetest_lot_number', 'geetest_captcha_output', 'geetest_pass_token', 'geetest_gen_time',
-        'aliyun_captcha_verify_param'
-      ];
-      keys.forEach(function (key) {
-        var input = mount.querySelector('input[name="' + key + '"]');
-        if (input && input.value !== '') payload[key] = input.value;
-      });
-      return payload;
-    }
-
-    function resetCaptcha() {
-      var state = window.AKSRTCaptchaState;
-      var scene = state && state.scenes && state.scenes.signin;
-      if (scene && typeof scene.reset === 'function') scene.reset();
-    }
-
-    function triggerCaptcha(onSuccess, onFail) {
-      var mount = captchaMount();
-      var state = window.AKSRTCaptchaState;
-      var scene = state && state.scenes && state.scenes.signin;
-
-      if (scene && typeof scene.verify === 'function') {
-        scene.verify(function (ok) {
-          if (ok === false) {
-            onFail('已取消验证');
-            return;
-          }
-          onSuccess();
-        });
-        return;
-      }
-      if (mount) {
-        onFail('人机验证加载中，请稍候再试');
-        return;
-      }
-      onSuccess();
-    }
-
-    function doSignin() {
+    function doSignin(captchaPayload) {
       notyf('正在签到…', 'load', '', 'aksrt-balance-signin-toast');
       api('/signin', {
         method: 'POST',
-        body: JSON.stringify({ captcha: collectCaptcha() })
+        body: JSON.stringify({ captcha: captchaPayload || {} })
       }).then(function (result) {
         signinBusy = false;
         if (!result.ok) {
-          resetCaptcha();
           notyf((result.json && result.json.message) || '签到失败', 'danger', 5, 'aksrt-balance-signin-toast');
           setButtonState('idle');
           return;
@@ -166,6 +120,8 @@
         });
         setButtonState('done');
         refresh();
+      }).finally(function () {
+        if (window.AKSRTCaptcha) window.AKSRTCaptcha.reset('signin', captchaMount());
       });
     }
 
@@ -176,10 +132,15 @@
 
         signinBusy = true;
         setButtonState('busy');
-        triggerCaptcha(doSignin, function (message) {
+        var captcha = window.AKSRTCaptcha;
+        var mount = captchaMount();
+        (captcha ? captcha.run('signin', mount) : Promise.resolve({})).then(function (payload) {
+          if (payload === null) throw new Error('已取消验证');
+          doSignin(payload);
+        }).catch(function (error) {
           signinBusy = false;
-          resetCaptcha();
-          if (message) notyf(message, 'danger');
+          if (captcha) captcha.reset('signin', mount);
+          notyf((error && error.message) || '人机验证加载中，请稍候再试', 'danger');
           setButtonState('idle');
         });
       });