AND feature flags with user_caps balance_transfer / points_transfer / balance_withdraw on REST and user-center buttons.
Rewrite captcha core around aksrt_captcha_config only, require captcha on login/comment/SMS/phone auth and related gates, wire frontend token collection, and remove dead dual-source security settings plus slider enqueue.