feat: Turnstile captcha, menu khách + nút tắt topbar cấu hình từ admin, ẩn setting nhạy cảm

- Turnstile (App\Support\Turnstile, middleware turnstile) cho login admin và login/register/forgot/reset của khách; cấu hình ở setting key=turnstile, secret mã hoá SignRSA.
- Menu sidebar khách (setting client_menu) và nút tắt topbar (setting client_quick_links) do admin sửa qua administrator/client-menu[/quick-links], khách đọc v1/setting/menu, v1/setting/quick-links.
- v1/setting và settings/public chỉ trả whitelist PublicSetting::FIELDS (trước đây lộ bot_token, inet_api_key).
- Cài đặt tài khoản khách (preferences), rate limit theo IP cho register/resend-verify.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/Api/Setting/SettingController.php

@@ -4,6 +4,10 @@ namespace App\Http\Controllers\Api\Setting;
 
 use App\Http\Controllers\Controller;
 use App\Models\Setting;
+use App\Support\ClientMenu;
+use App\Support\ClientQuickLinks;
+use App\Support\PublicSetting;
+use App\Support\Turnstile;
 
 /**
  * @OA\Tag(
@@ -19,7 +23,7 @@ class SettingController extends Controller
      *     operationId="getSetting",
      *     tags={"Settings"},
      *     summary="Get application settings",
-     *     description="Returns the application settings",
+     *     description="Returns the public application settings (title, company, logo, favi_icon, brand_color)",
      *     @OA\Response(
      *         response=200,
      *         description="Successful operation",
@@ -31,11 +35,10 @@ class SettingController extends Controller
      *     )
      * )
      */
-    public function getSetting()
+    public function getSetting(): \Illuminate\Http\JsonResponse
     {
-        $setting = Setting::where('key', 'setting')->first();
         return response()->json([
-            'data' => $setting->value,
+            'data' => PublicSetting::values(),
             'message' => 'Get setting successfully',
             'error' => false
         ]);
@@ -53,4 +56,28 @@ class SettingController extends Controller
             ],
         ]);
     }
-}
+
+    public function getTurnstileSetting(): \Illuminate\Http\JsonResponse
+    {
+        return response()->json([
+            'error' => false,
+            'data'  => ['site_key' => Turnstile::siteKey()],
+        ]);
+    }
+
+    public function getMenu(): \Illuminate\Http\JsonResponse
+    {
+        return response()->json([
+            'error' => false,
+            'data'  => ClientMenu::items(),
+        ]);
+    }
+
+    public function getQuickLinks(): \Illuminate\Http\JsonResponse
+    {
+        return response()->json([
+            'error' => false,
+            'data'  => ClientQuickLinks::items(),
+        ]);
+    }
+}