fix(config): serve public settings and enforce login CAP

Public config now comes from admin as a flat visibility=1 map instead of
a cross-plugin query that compared an integer column to "visible". Login
and register resolve CaptchaService per request so CAP is not skipped
when user applies before cap.

backend/docs/docs.go

@@ -4538,7 +4538,7 @@ const docTemplate = `{
         },
         "/api/v1/config/public": {
             "get": {
-                "description": "返回系统配置表中 visibility 为 1 的配置键值集合",
+                "description": "返回系统配置表中 visibility 为 1 的扁平键值集合（如 cap_login_enabled）",
                 "consumes": [
                     "application/json"
                 ],

backend/docs/swagger.json

@@ -4531,7 +4531,7 @@
         },
         "/api/v1/config/public": {
             "get": {
-                "description": "返回系统配置表中 visibility 为 1 的配置键值集合",
+                "description": "返回系统配置表中 visibility 为 1 的扁平键值集合（如 cap_login_enabled）",
                 "consumes": [
                     "application/json"
                 ],

backend/docs/swagger.yaml

@@ -4115,7 +4115,7 @@ paths:
     get:
       consumes:
       - application/json
-      description: 返回系统配置表中 visibility 为 1 的配置键值集合
+      description: 返回系统配置表中 visibility 为 1 的扁平键值集合（如 cap_login_enabled）
       produces:
       - application/json
       responses: