fix(config): serve public settings and enforce login CAP

Public config now comes from admin as a flat visibility=1 map instead of
a cross-plugin query that compared an integer column to "visible". Login
and register resolve CaptchaService per request so CAP is not skipped
when user applies before cap.

backend/core/contracts/config_public.go

@@ -5,8 +5,10 @@ package contracts
 
 import "context"
 
-// PublicConfigProvider supplies the payload for GET /api/v1/config/public
-// when a downstream plugin replaces Wavelet's default {configs, app} JSON.
+// PublicConfigProvider supplies GET /api/v1/config/public.
+// The owner of w_system_configs (admin) must provide this. The payload is a
+// flat key/value map of visibility=1 rows; the frontend reads keys such as
+// cap_login_enabled directly off data.
 type PublicConfigProvider interface {
-	PublicConfig(ctx context.Context) (any, error)
+	PublicConfig(ctx context.Context) (map[string]string, error)
 }