feat: implement general captcha code for consistent rendering and caching

.codex/skills/shz-pc-debug/references/deployment.md

@@ -0,0 +1,36 @@
+# SHZ Test Deployment
+
+## Authorization gate
+
+Run a commit or deployment only if the user's **current request** explicitly authorizes it, names the test environment, and identifies the backend, PC frontend, or both. A request to complete a task, verify a fix, or describe deployment is not authorization to run these commands.
+
+Before running a deployment command:
+
+1. Inspect the selected repository's `git status` and diff.
+2. Stage and commit only the files required for the task after focused local validation succeeds.
+3. Do not include credentials, unrelated changes, or generated artifacts unless the user explicitly includes them in scope.
+4. Do not push unless the user explicitly requests a push.
+
+## Backend test deployment
+
+Use only for an explicitly authorized `shz-backend` **test** deployment:
+
+```bash
+ssh root@47.111.103.66 sh /data/code/shz-backend/buildAndStart-test.sh
+```
+
+This command changes the remote test environment and can restart its backend service. After it finishes, inspect the requested test route and, on a failure, read a bounded test-log window with `$inspect-shz-logs`.
+
+## PC frontend deployment
+
+Use only for an explicitly authorized `shz-admin` PC frontend deployment:
+
+```bash
+sh /Users/lapuda/code/shz-admin/scripts/deploy-frontend.sh
+```
+
+Run the command locally. After it finishes, use Chrome DevTools to reload and verify the requested PC test route.
+
+## Production
+
+No production deployment command is configured in this skill. The production base URL is not deployment authority. Require a separate, explicit current-request authorization and the exact command before any production deployment.

.codex/skills/shz-pc-debug/references/project-topology.md

@@ -0,0 +1,21 @@
+# SHZ Project Topology
+
+| Workspace | Responsibility | Use during debugging |
+| --- | --- | --- |
+| `/Users/lapuda/code/shz-backend` | Backend project | Investigate API routing, authorization, business services, scheduled work, persistence, and server errors. Use the project's log and guarded database skills here. |
+| `/Users/lapuda/code/shz-admin` | PC frontend | Investigate PC job-seeker, supervisory-admin, and enterprise UI routes, components, client state, request construction, and browser interaction. |
+| `/Users/lapuda/code/shz-employment-service` | Mini-program | Investigate only mini-program-specific behavior, or a suspected interface/authentication/business-logic concern shared with the PC application. |
+
+## Select the minimum scope
+
+1. Start a PC visual, interaction, navigation, or missing-request investigation in `shz-admin` after capturing browser evidence.
+2. Start an API status, response, permission, server exception, or database-data investigation in `shz-backend`.
+3. Investigate both `shz-admin` and `shz-backend` when the browser request or response shows that the failure crosses the client/server boundary.
+4. Add `shz-employment-service` only after evidence indicates the same endpoint or business behavior is involved. Do not change mini-program code for a PC-only issue.
+
+## Work safely across repositories
+
+1. Change into the selected workspace before using CodeGraph, running checks, or editing files.
+2. Check each repository's working tree independently and preserve unrelated changes.
+3. Attempt CodeGraph in the selected workspace before broad text search. If its index is unavailable, do not create one; use `rg` as the fallback.
+4. Run focused verification in every repository changed. Do not deploy, restart services, or alter a remote environment unless the current user request explicitly authorizes committing and deploying; then follow [deployment.md](deployment.md).

.codex/skills/shz-pc-debug/references/test-environment.md

@@ -0,0 +1,30 @@
+# SHZ Web Test Environment
+
+## Environment selection
+
+- Default environment: **test**. Use the exact HTTPS URLs below.
+- Production base: `http://39.98.44.136:6024/`. Use it only when the user explicitly requests production in the current conversation. Compose the requested route after this base; do not infer production availability from a test URL.
+- Do not deploy, restart a service, alter configuration, or write business data in either environment as part of debugging unless the user explicitly requests it.
+
+## Test entries
+
+| Role / purpose | Test URL | Use |
+| --- | --- | --- |
+| PC job seeker | `https://test.xjshzly.longbiosphere.com/shihezi` | Reproduce public job-search, job-fair, resume, policy, and message flows. |
+| Authenticated PC job seeker | `https://test.xjshzly.longbiosphere.com/shihezi/backDoor` | Use the testing back door to select the one user required by the scenario. When it prompts for image verification, enter `820820`. Do not enumerate unrelated users. |
+| Supervisory admin | `https://test.xjshzly.longbiosphere.com/shihezi/user/login` | Use the admin role on the shared login page. |
+| Enterprise | `https://test.xjshzly.longbiosphere.com/shihezi/user/login` | Use the enterprise role on the shared login page. |
+
+The public job-seeker root can redirect to a feature route; capture the final URL in the debug evidence instead of treating that redirect as a failure by itself.
+
+## Test login details
+
+Use these only on the test endpoints above and only when role authentication is required to reproduce the reported issue.
+
+| Role | Account / selection | Password | Image verification code |
+| --- | --- | --- | --- |
+| Test-user back door | Select only the user required by the scenario | Not applicable | `820820` |
+| Supervisory admin | `admin` | `admin123` | `820820` |
+| Enterprise | `阿里巴巴` | `820820` | `820820` |
+
+Do not put these credentials into code, commits, screenshots, browser logs, test fixtures, or final reports. If a login attempt fails, report the role and failure symptom without echoing the credential values.