refactor(auth): improve session security, CAPTCHA validation and code hygiene

- Integrate CapWidget with dual-scope capability on the frontend and protect registration/send-email-code endpoints on the backend.
- Set session cookie SameSite mode to Lax.
- Propagate request context through auth source database operations and optimize username uniqueness validation.
- Standardize local error naming to camelCase and resolve references.
- Fix linter rules, missing SheetContent closing tag, and unit tests.

internal/util/session.go

@@ -20,6 +20,7 @@ func GetSessionOptions(maxAge int) sessions.Options {
 		MaxAge:   maxAge,
 		HttpOnly: config.Config.App.SessionHTTPOnly,
 		Secure:   config.Config.App.SessionSecure,
+		SameSite: http.SameSiteLaxMode,
 	}
 }