feat: 注册流程强制图形验证码

SSR 注册页与 /api/register 共用 CaptchaService，防刷同时保留换一张无 JS 刷新。

Co-authored-by: Cursor <cursoragent@cursor.com>

routers/api/handlers.go

@@ -237,11 +237,17 @@ func (h *Handlers) APIRegister(c *gin.Context) {
 		Nickname  string `json:"nickname" form:"nickname"`
 		Email     string `json:"email" form:"email" binding:"required"`
 		EmailCode string `json:"email_code" form:"email_code"`
+		CaptchaID string `json:"captcha_id" form:"captcha_id"`
+		Captcha   string `json:"captcha" form:"captcha"`
 	}
 	if err := c.ShouldBind(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
 		return
 	}
+	if h.Captcha == nil || !h.Captcha.Verify(req.CaptchaID, req.Captcha) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "验证码错误或已过期"})
+		return
+	}
 
 	userCount := h.Auth.UserCount()
 	mailReady := h.Settings.MailReady()