- Drop the download config menu entry, route and schema from the settings SPA
- Remove the PHP schema section, the server-side alias validation and the
reserved-alias list that only served that section
- Unregister aksrt_download_config from standalone import/export keys
- Drop the contract tests that locked the removed page; the Download.php
runtime contracts stay untouched
Remove duplicate comment, captcha, filing, and website-security configuration paths.
Move front submission verification to the captcha scene matrix and retire obsolete admin routes and components.
- P1: remove the duplicate "审核联动" (ai_moderate_background/submit)
block from the attachment permissions page; those settings live in
the "评论审核" / API content audit surfaces.
- P2: rename the "内容审核" submenu to "评论审核" (permissions domain).
- P4: remove the "下载/付费内容中心" page and its schema/route chain;
hardcode runtime policy so download always supports credit purchase
and paid content is limited to posts. Drop the now-dead
cms_features.download_credit flag and parse_slug_list helper.
Add bind_phone captcha scene across schema/runtime/UI, require captcha on
phone bind, return real captcha status objects instead of legacy option
aliases, and harden form discovery for page-sign auth forms.
Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.
Delete aksrt-compat.php and rewire messages/PM entry points to the user
center notification route. Normalize permissions login dependsOn objects
and allow an explicit empty captcha provider option so login/moderation
schema pages remain loadable without legacy compatibility shims.
kate522
