Local WP has empty permalink_structure so /wp-json/* 404s on Apache.
modal-auth fell back to /wp-json/aksrt/v1; prefer aksrtData.restUrl
(index.php?rest_route=/aksrt/v1) and join paths correctly.
Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.
kate522
