- Admin: 登录权限 → 人机验证; 停用场景 → 启用场景 (opt-in) - Normalize enabled_scenarios with legacy disabled_scenarios BC - Sign-in: never soft-bypass captcha; cancel unlocks button - Captcha JS: cancel path finishes pending callback as false
Rewrite captcha core around aksrt_captcha_config only, require captcha on login/comment/SMS/phone auth and related gates, wire frontend token collection, and remove dead dual-source security settings plus slider enqueue.