feat(captcha): 打通人机验证 11 个场景的前后端完整链路

- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝
- 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名
- challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制
- 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费
- 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿
- 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码
- 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射
- 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config
- 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness

src/Core/CommentActions.php

@@ -284,15 +284,18 @@ class CommentActions {
             ], 403);
         }
 
-        if (function_exists('aksrt_require_captcha')) {
-            $captcha_result = aksrt_require_captcha('comment', $params);
-            if ($captcha_result !== true) {
-                return new \WP_REST_Response([
-                    'success' => false,
-                    'code'    => 'captcha_failed',
-                    'message' => (string) $captcha_result,
-                ], 400);
-            }
+        $captcha_result = aksrt_require_captcha('comment', $params);
+        if ($captcha_result !== true) {
+            $captcha_error = is_wp_error($captcha_result) ? $captcha_result : null;
+            $captcha_data = $captcha_error ? $captcha_error->get_error_data() : null;
+            $captcha_status = is_array($captcha_data) ? (int) ($captcha_data['status'] ?? 400) : 400;
+            return new \WP_REST_Response([
+                'success' => false,
+                'code'    => $captcha_error ? ($captcha_error->get_error_code() ?: 'captcha_failed') : 'captcha_failed',
+                'message' => $captcha_error
+                    ? ($captcha_error->get_error_message() ?: __('人机验证失败', 'aksrt'))
+                    : __('人机验证失败', 'aksrt'),
+            ], $captcha_status > 0 ? $captcha_status : 400);
         }
 
         $user = wp_get_current_user();
@@ -335,7 +338,17 @@ class CommentActions {
             }
         }
 
-        $comment_id = wp_new_comment(wp_slash($commentdata), true);
+        $comment_id = null;
+        if (class_exists('\AKSRT\Auth\Moderation')) {
+            \AKSRT\Auth\Moderation::get_instance()->begin_captcha_verified_comment_request();
+        }
+        try {
+            $comment_id = wp_new_comment(wp_slash($commentdata), true);
+        } finally {
+            if (class_exists('\AKSRT\Auth\Moderation')) {
+                \AKSRT\Auth\Moderation::get_instance()->end_captcha_verified_comment_request();
+            }
+        }
         if (is_wp_error($comment_id)) {
             return new \WP_REST_Response([
                 'success' => false,

src/Core/FrontSubmit.php

@@ -363,6 +363,9 @@ class FrontSubmit {
         }
         $data['posts_id'] = $post_id;
         $action = (($data['status'] ?? '') === 'draft') ? 'posts_draft' : 'posts_save';
+        if ($action !== 'posts_draft') {
+            $this->verify_captcha();
+        }
         $result = $this->persist($data, $action);
         $this->send_result($result);
     }
@@ -425,13 +428,15 @@ class FrontSubmit {
     }
 
     private function verify_captcha(): void {
-        if (!function_exists('aksrt_require_captcha')) {
-            return;
-        }
         $verify = aksrt_require_captcha('front_submit', $_POST);
         if ($verify !== true) {
+            $captcha_error = is_wp_error($verify) ? $verify : null;
+            $message = $captcha_error
+                ? $captcha_error->get_error_message()
+                : __('人机验证失败，请重试', 'aksrt');
             wp_send_json_error([
-                'message' => is_string($verify) ? $verify : __('人机验证失败，请重试', 'aksrt'),
+                'code'    => $captcha_error ? ($captcha_error->get_error_code() ?: 'aksrt_captcha_failed') : 'aksrt_captcha_failed',
+                'message' => $message !== '' ? $message : __('人机验证失败，请重试', 'aksrt'),
             ], 400);
         }
     }