feat: 注册流程强制图形验证码

SSR 注册页与 /api/register 共用 CaptchaService，防刷同时保留换一张无 JS 刷新。

Co-authored-by: Cursor <cursoragent@cursor.com>

templates/auth/register.tmpl

@@ -31,6 +31,14 @@
     <label>确认密码
       <input type="password" name="password2" required autocomplete="new-password" minlength="6"/>
     </label>
+    <label>图形验证码
+      <div class="j13-form__row j13-captcha">
+        <input type="hidden" name="captcha_id" value="{{.CaptchaID}}"/>
+        {{if .CaptchaSVG}}<span class="j13-captcha__img" aria-hidden="true">{{.CaptchaSVG}}</span>{{end}}
+        <input name="captcha" required autocomplete="off" maxlength="8" placeholder="请输入图中字符"/>
+        <a href="/register" class="j13-btn-secondary">换一张</a>
+      </div>
+    </label>
     <button type="submit">注册</button>
   </form>
   <p><a href="/login">已有账号？登录</a> · <a href="/">返回首页</a></p>