feat(captcha): 打通人机验证 11 个场景的前后端完整链路

- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝
- 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名
- challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制
- 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费
- 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿
- 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码
- 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射
- 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config
- 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness

src/Admin/ImportExportController.php

@@ -87,6 +87,12 @@ class ImportExportController extends ControllerBase {
             'permission_callback' => [$this, 'check_permission'],
         ]);
 
+        register_rest_route(self::API_NAMESPACE, '/captcha/test', [
+            'methods'             => 'POST',
+            'callback'            => [$this, 'rest_test_captcha'],
+            'permission_callback' => [$this, 'check_permission'],
+        ]);
+
         // Backup snapshots
         register_rest_route(self::API_NAMESPACE, '/settings/backups', [
             'methods'             => 'GET',
@@ -118,6 +124,42 @@ class ImportExportController extends ControllerBase {
     /*  Handlers                                                           */
     /* ------------------------------------------------------------------ */
 
+    public function rest_test_captcha(\WP_REST_Request $request): \WP_REST_Response {
+        $params = $this->get_json_params($request);
+        $provider = sanitize_key((string) ($params['provider'] ?? ''));
+        $token = isset($params['token']) && is_array($params['token']) ? $params['token'] : [];
+        $allowed_token_fields = [
+            'tencent_ticket', 'tencent_randstr',
+            'cf_turnstile_response',
+            'geetest_lot_number', 'geetest_captcha_output', 'geetest_pass_token', 'geetest_gen_time',
+            'aliyun_captcha_verify_param',
+        ];
+        $token = array_intersect_key($token, array_flip($allowed_token_fields));
+        foreach ($token as $key => $value) {
+            $token[$key] = is_scalar($value) ? sanitize_text_field((string) $value) : '';
+        }
+        $config = function_exists('aksrt_get_captcha_config') ? aksrt_get_captcha_config() : [];
+        $stored_provider = (string) ($config['active_provider'] ?? '');
+
+        if ($provider === '' || $provider !== $stored_provider || !in_array($provider, aksrt_captcha_providers(), true)) {
+            return $this->error(__('请先保存并启用要测试的人机验证服务商', 'aksrt'), 422);
+        }
+
+        $provider_config = isset($config[$provider]) && is_array($config[$provider]) ? $config[$provider] : [];
+        if (!aksrt_captcha_provider_is_configured($provider, $provider_config)) {
+            return $this->error(__('当前人机验证服务商配置不完整', 'aksrt'), 422);
+        }
+
+        $scene = 'admin-captcha-test';
+        $action = 'aksrt-admin-test';
+        $result = aksrt_verify_captcha_provider($provider, $provider_config, $token, aksrt_get_client_ip(), $scene, $action);
+        if (is_wp_error($result)) {
+            return $this->error($result->get_error_message(), 422);
+        }
+
+        return $this->success(['message' => __('服务端同源验签通过', 'aksrt')]);
+    }
+
     /**
      * Export all AKSRT settings as a JSON-serializable array.
      */
@@ -139,7 +181,7 @@ class ImportExportController extends ControllerBase {
         }
 
         // Also export standalone options from the registry
-        $standalone_keys = \AKSRT\Settings\Settings::STANDALONE_OPTION_KEYS;
+        $standalone_keys = \AKSRT\Settings\Settings::standalone_export_keys();
 
         $export['standalone'] = [];
         foreach ($standalone_keys as $key) {
@@ -180,21 +222,25 @@ class ImportExportController extends ControllerBase {
         // Import domain settings
         if (!empty($params['domains']) && is_array($params['domains'])) {
             foreach ($params['domains'] as $domain => $payload) {
+                if (!in_array($domain, $schema_provider->get_domain_keys(), true)) {
+                    $results[$domain] = ['status' => 'skipped', 'message' => 'Unknown domain'];
+                    continue;
+                }
                 $data = $payload['data'] ?? $payload;
                 if (!is_array($data)) {
                     $results[$domain] = ['status' => 'error', 'message' => 'Invalid data format'];
                     continue;
                 }
 
-                // Validate
-                $validation = $schema_provider->validate($domain, $data);
+                $clean = $schema_provider->sanitize_payload((string) $domain, $data);
+                $validation = $schema_provider->validate((string) $domain, $clean);
                 if (!$validation['valid']) {
                     $results[$domain] = ['status' => 'error', 'errors' => $validation['errors']];
                     continue;
                 }
 
                 if (!$dry_run) {
-                    $schema_provider->write_settings($domain, $data);
+                    $schema_provider->write_settings((string) $domain, $clean);
                     $results[$domain] = ['status' => 'imported'];
                 } else {
                     $results[$domain] = ['status' => 'valid'];