Add bind_phone captcha scene across schema/runtime/UI, require captcha on
phone bind, return real captcha status objects instead of legacy option
aliases, and harden form discovery for page-sign auth forms.
Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.
Delete aksrt-compat.php and rewire messages/PM entry points to the user
center notification route. Normalize permissions login dependsOn objects
and allow an explicit empty captcha provider option so login/moderation
schema pages remain loadable without legacy compatibility shims.
kate522
