feat: integrate client and server sharing workflows

web/src/core-bridge/captcha.ts

@@ -0,0 +1,25 @@
+const API_BASE = import.meta.env.VITE_WEBDROP_API_URL ?? '/api/v1';
+
+interface ServerInfo {
+  captcha?: { enabled?: boolean; api_endpoint?: string };
+}
+
+/** Cap performs challenge solving in its own workers and only returns a one-use token. */
+export async function solveCreationCaptcha(): Promise<string | undefined> {
+  const response = await fetch(`${API_BASE.replace(/\/$/, '')}/info`, {
+    cache: 'no-store',
+    credentials: 'omit',
+    referrerPolicy: 'no-referrer',
+  });
+  if (!response.ok) throw new Error('无法读取服务端能力');
+  const info = await response.json() as ServerInfo;
+  if (!info.captcha?.enabled) return undefined;
+  if (typeof info.captcha.api_endpoint !== 'string') throw new Error('验证码服务配置无效');
+
+  // Cap's official client owns the challenge protocol and WASM worker implementation; bundling it avoids a runtime CDN script.
+  const { default: Cap } = await import('cap-widget');
+  const config = { apiEndpoint: info.captcha.api_endpoint, workers: 2 } as ConstructorParameters<typeof Cap>[0] & { workers: number };
+  const { token } = await new Cap(config).solve();
+  if (!token) throw new Error('验证码未完成');
+  return token;
+}