feat(captcha): 打通人机验证 11 个场景的前后端完整链路

- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝
- 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名
- challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制
- 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费
- 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿
- 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码
- 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射
- 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config
- 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness

tests/widget-system/oauth-security-contract.test.cjs

@@ -119,6 +119,20 @@ test('PHP and JavaScript OAuth schema field keys stay in parity', () => {
   const jsKeys = [...js.matchAll(/\{ key: '([^']+)', label:/g)].map((match) => match[1])
   assert.deepEqual([...new Set(phpKeys)].sort(), [...new Set(jsKeys)].sort())
 })
+test('OAuth bind starts require a one-time captcha bind pass', () => {
+  const oauth = read('src/Auth/OAuth.php')
+  const weixingzh = read('src/Auth/WeixinGzh.php')
+  const bindings = read('inc/helpers/user-center-renderers/settings-bindings.php')
+  assert.match(oauth, /\/oauth\/bind-pass/)
+  assert.match(oauth, /BIND_PASS_KIND = 'oauth_bind_pass'/)
+  assert.match(oauth, /OAuthTransactionStore::issue\(self::BIND_PASS_KIND/)
+  assert.match(oauth, /OAuthTransactionStore::claim\(\$token, self::BIND_PASS_KIND, true\)/)
+  assert.match(oauth, /validate_bind_pass\(\$bind_pass, \$provider, \$user_id, true\)/)
+  assert.match(oauth, /validate_bind_pass\(\$bind_pass, 'clogin_' \. \$type, get_current_user_id\(\), true\)/)
+  assert.match(weixingzh, /OAuth::validate_bind_pass\(\$bind_pass, 'weixingzh'/)
+  assert.match(bindings, /aksrt_render_captcha\('bind'\)/)
+})
+
 test('OAuth result handler maps safe errors and preserves unrelated URL state', () => {
   const notices = []
   let replaced = ''