feat(captcha): 打通人机验证 11 个场景的前后端完整链路

- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝
- 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名
- challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制
- 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费
- 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿
- 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码
- 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射
- 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config
- 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness

src/Settings/Settings.php

@@ -47,11 +47,16 @@ class Settings {
         'aksrt_identity_secrets',
     ];
 
+    public const SCHEMA_MANAGED_STANDALONE_OPTION_KEYS = [
+        'aksrt_captcha_config',
+    ];
+
     /**
-     * 包含 secret 字段的 option key — 空值保留旧值策略。
+     * 包含 secret 字段的 option key — 永不进入独立导入导出。
      */
     public const SECRET_OPTION_KEYS = [
         'aksrt_mail_smtp',
+        'aksrt_captcha_config',
         'aksrt_identity_secrets',
     ];
 
@@ -601,15 +606,20 @@ class Settings {
         return \AKSRT\Identity\SecretStore::status($provider);
     }
 
+    public static function standalone_export_keys(): array {
+        return array_values(array_diff(self::STANDALONE_OPTION_KEYS, self::SCHEMA_MANAGED_STANDALONE_OPTION_KEYS, self::SECRET_OPTION_KEYS));
+    }
+
     /**
-     * Remove secrets from settings export and backup payloads.
+     * Remove duplicate schema-managed options and secrets from settings payloads.
      *
      * @param array<string,mixed> $payload
      * @return array<string,mixed>
      */
     public static function redact_sensitive_settings(array $payload): array {
         if (isset($payload['standalone']) && is_array($payload['standalone'])) {
-            foreach (self::SECRET_OPTION_KEYS as $option_key) {
+            $blocked = array_merge(self::SCHEMA_MANAGED_STANDALONE_OPTION_KEYS, self::SECRET_OPTION_KEYS);
+            foreach ($blocked as $option_key) {
                 unset($payload['standalone'][$option_key]);
             }
         }
@@ -623,10 +633,11 @@ class Settings {
      * @return array<string,mixed>
      */
     public static function filter_sensitive_import(array $standalone): array {
-        foreach (self::SECRET_OPTION_KEYS as $option_key) {
+        $blocked = array_merge(self::SCHEMA_MANAGED_STANDALONE_OPTION_KEYS, self::SECRET_OPTION_KEYS);
+        foreach ($blocked as $option_key) {
             unset($standalone[$option_key]);
         }
-        return $standalone;
+        return array_intersect_key($standalone, array_flip(self::standalone_export_keys()));
     }