Rewrite captcha core around aksrt_captcha_config only, require captcha on login/comment/SMS/phone auth and related gates, wire frontend token collection, and remove dead dual-source security settings plus slider enqueue.
custom 类型 schema 现按 array 深度净化保存;前台启用但凭据未齐时跳过渲染,Geetest 客户端也校验 captchaId。