feat: Turnstile captcha, menu khách + nút tắt topbar cấu hình từ admin, ẩn setting nhạy cảm

- Turnstile (App\Support\Turnstile, middleware turnstile) cho login admin và login/register/forgot/reset của khách; cấu hình ở setting key=turnstile, secret mã hoá SignRSA.
- Menu sidebar khách (setting client_menu) và nút tắt topbar (setting client_quick_links) do admin sửa qua administrator/client-menu[/quick-links], khách đọc v1/setting/menu, v1/setting/quick-links.
- v1/setting và settings/public chỉ trả whitelist PublicSetting::FIELDS (trước đây lộ bot_token, inet_api_key).
- Cài đặt tài khoản khách (preferences), rate limit theo IP cho register/resend-verify.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

routes/api/admin/system.php

@@ -4,6 +4,7 @@ use App\Http\Controllers\Api\Admin\ActivityLog\ActivityLogController;
 use App\Http\Controllers\Api\Admin\EmailLog\EmailLogController;
 use App\Http\Controllers\Api\Admin\EmailTemplate\EmailTemplateController;
 use App\Http\Controllers\Api\Admin\MailCampaign\MailCampaignController;
+use App\Http\Controllers\Api\Admin\Setting\ClientMenuController;
 use App\Http\Controllers\Api\Admin\Setting\SettingController as AdminSettingController;
 use App\Http\Controllers\Api\Admin\Staff\StaffOnlineController;
 use App\Http\Controllers\Api\Admin\Ticket\TicketController as AdminTicketController;
@@ -21,6 +22,16 @@ Route::prefix('settings')
         Route::post('test-telegram', 'testTelegram');
     });
 
+Route::prefix('client-menu')
+    ->controller(ClientMenuController::class)
+    ->middleware('perm:setting.manager')
+    ->group(function () {
+        Route::get('/', 'show');
+        Route::put('/', 'update');
+        Route::get('quick-links', 'showQuickLinks');
+        Route::put('quick-links', 'updateQuickLinks');
+    });
+
 // VAT settings per service type (module: settings)
 Route::prefix('vat-settings')
     ->controller(AdminSettingController::class)