修改功，现在补齐页面

public/js/security-pages.js

@@ -15,6 +15,14 @@
   'use strict';
 
   var documentRef = root.document;
+  var CAPTCHA_SCENES = {
+    password: 'WEB_H5_CHANGE_PASSWORD',
+    phone: 'WEB_H5_CHANGE_PHONE'
+  };
+
+  function getCaptchaScene(formType) {
+    return CAPTCHA_SCENES[formType] || '';
+  }
 
   function hashPassword(value) {
     // 接口文档要求密码提交 32 位 MD5，测试环境可传入 hashFn 替代。
@@ -35,7 +43,8 @@
 
     return {
       oldPassword: hash(String(source.oldPassword || '').trim()),
-      newPassword: hash(String(source.newPassword || '').trim())
+      newPassword: hash(String(source.newPassword || '').trim()),
+      validToken: trimOrUndefined(source.validToken)
     };
   }
 
@@ -67,6 +76,23 @@
     return root.GenealogyApi && root.GenealogyApi.defaultClient;
   }
 
+  async function ensureCaptcha(form, formType, subject) {
+    // 改密和换绑必须先取得与当前业务场景绑定的验证码票据。
+    var captcha = root.CaptchaPages;
+    var sceneCode = getCaptchaScene(formType);
+
+    if (!sceneCode) return true;
+    if (!captcha || !captcha.ensureToken) {
+      showMessage('验证码组件未加载，请刷新后重试');
+      return false;
+    }
+
+    return Boolean(await captcha.ensureToken(form, {
+      sceneCode: sceneCode,
+      subject: subject || ''
+    }));
+  }
+
   function query(selector, rootNode) {
     return (rootNode || documentRef).querySelector(selector);
   }
@@ -114,6 +140,9 @@
       return;
     }
 
+    if (!await ensureCaptcha(form, 'password')) return;
+    values = getFormValues(form);
+
     try {
       await api.changePassword(buildPasswordChangeBody(values));
       setStatus(form, '密码已修改');
@@ -134,6 +163,9 @@
       return;
     }
 
+    if (!await ensureCaptcha(form, 'phone', body.newPhone)) return;
+    body = buildPhoneChangeBody(getFormValues(form));
+
     try {
       await api.changePhone(body);
       setStatus(form, '手机号已换绑');
@@ -144,6 +176,36 @@
     }
   }
 
+  async function sendPhoneCode(button) {
+    // 换绑手机号使用独立短信场景，避免复用登录或找回密码票据。
+    var api = getApi();
+    var form = query('[data-security-form="phone"]');
+    var values;
+
+    if (!api || !form) return;
+    values = getFormValues(form);
+    if (!/^1[3-9]\d{9}$/.test(String(values.newPhone || '').trim())) {
+      showMessage('请输入正确的新手机号');
+      return;
+    }
+    if (!await ensureCaptcha(form, 'phone', values.newPhone)) return;
+    values = getFormValues(form);
+    button.disabled = true;
+
+    try {
+      await api.sendSmsCode({
+        phone: values.newPhone,
+        sceneCode: getCaptchaScene('phone'),
+        validToken: values.validToken || ''
+      });
+      showMessage('验证码已发送');
+    } catch (error) {
+      showMessage(error.message || '验证码发送失败');
+    } finally {
+      button.disabled = false;
+    }
+  }
+
   async function submitDeactivate(form) {
     var api = getApi();
     var values = getFormValues(form);
@@ -176,7 +238,7 @@
     try {
       if (api) await api.logout();
     } catch (error) {
-      // ApiClient.logout 会在请求失败时清理本地 token，页面仍应离开受保护区域。
+      // 退出请求失败时客户端仍会清理本地令牌，页面必须离开受保护区域。
     } finally {
       root.location.href = 'index.html';
     }
@@ -199,8 +261,14 @@
     });
 
     documentRef.addEventListener('click', function (event) {
+      var codeButton = event.target.closest('[data-security-send-code]');
       var button = event.target.closest('[data-security-logout]');
 
+      if (codeButton) {
+        event.preventDefault();
+        sendPhoneCode(codeButton);
+        return;
+      }
       if (!button) return;
       event.preventDefault();
       logout();
@@ -217,6 +285,7 @@
     buildPasswordChangeBody: buildPasswordChangeBody,
     buildPhoneChangeBody: buildPhoneChangeBody,
     buildDeactivateBody: buildDeactivateBody,
+    getCaptchaScene: getCaptchaScene,
     isDangerConfirmed: isDangerConfirmed,
     init: init
   };