feat(captcha): 打通人机验证 11 个场景的前后端完整链路

- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝
- 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名
- challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制
- 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费
- 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿
- 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码
- 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射
- 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config
- 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness

src/Admin/Schema/SchemaPermissions.php

@@ -10,6 +10,23 @@ defined('ABSPATH') || exit;
 class SchemaPermissions {
 
     public static function build(): array {
+		$provider_meta = function_exists('aksrt_captcha_provider_metadata') ? aksrt_captcha_provider_metadata() : [];
+		$provider_options = [['label' => '关闭', 'value' => '']];
+		$provider_fields = [];
+		foreach ($provider_meta as $provider => $meta) {
+			$provider_options[] = [
+				'label' => (string) ($meta['label'] ?? $provider),
+				'value' => $provider,
+			];
+			$provider_fields[] = [
+				'key'              => $provider,
+				'label'            => (string) ($meta['label'] ?? $provider) . ' 配置',
+				'type'             => 'custom',
+				'default'          => function_exists('aksrt_captcha_provider_defaults') ? aksrt_captcha_provider_defaults($provider) : [],
+				'captcha_provider' => $provider,
+			];
+		}
+
         return [
             'domain'   => 'permissions',
             'title'    => '功能与权限',
@@ -22,14 +39,8 @@ class SchemaPermissions {
                     'groups'     => [
                         ['key' => 'basic', 'title' => '基础开关', 'fields' => [
                             ['key' => 'enabled', 'label' => '启用人机验证', 'type' => 'switch', 'default' => false],
-                            ['key' => 'active_provider', 'label' => '当前服务商', 'type' => 'radio', 'default' => '', 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => [
-                                ['label' => '关闭', 'value' => ''],
-                                ['label' => '腾讯云 Captcha', 'value' => 'tencent'],
-                                ['label' => '阿里云 CAPTCHA 2.0', 'value' => 'aliyun'],
-                                ['label' => 'Cloudflare Turnstile', 'value' => 'cloudflare'],
-                                ['label' => '极验 GeeTest', 'value' => 'geetest'],
-                            ]],
-                            ['key' => 'enabled_scenarios', 'label' => '启用场景', 'type' => 'checkbox', 'default' => ['comment', 'login', 'register', 'bind', 'bind_phone', 'lostpassword', 'change_password', 'change_email', 'download', 'signin'], 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => [
+                            ['key' => 'active_provider', 'label' => '当前服务商', 'type' => 'radio', 'default' => '', 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => $provider_options],
+                            ['key' => 'enabled_scenarios', 'label' => '启用场景', 'type' => 'checkbox', 'default' => [], 'dependsOn' => ['key' => 'enabled', 'value' => true], 'options' => [
                                 ['label' => '发表评论', 'value' => 'comment'],
                                 ['label' => '用户登录', 'value' => 'login'],
                                 ['label' => '用户注册', 'value' => 'register'],
@@ -43,12 +54,7 @@ class SchemaPermissions {
                                 ['label' => '前台投稿', 'value' => 'front_submit'],
                             ]],
                         ]],
-                        ['key' => 'providers', 'title' => '服务商配置', 'fields' => [
-                            ['key' => 'tencent', 'label' => '腾讯云配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
-                            ['key' => 'aliyun', 'label' => '阿里云配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
-                            ['key' => 'cloudflare', 'label' => 'Cloudflare 配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
-                            ['key' => 'geetest', 'label' => '极验配置', 'type' => 'custom', 'default' => [], 'sanitize_type' => 'array'],
-                        ]],
+                        ['key' => 'providers', 'title' => '服务商配置', 'fields' => $provider_fields],
                     ],
                 ],
                 'attachment' => [