docs: 补充 v1.2.7 登录验证（滑块 / Turnstile / Cap）文档

docs-site/en/guide/users-and-permissions.md

@@ -12,6 +12,7 @@ PicHost uses role-based access control (RBAC): **admin** and **user**. Enforceme
 | Storage management (`/storage`) | ✓ | — |
 | System settings (`/settings`) | ✓ | — |
 | Allow registration | ✓ | — |
+| Login verification (slider / Turnstile / Cap) | ✓ | — |
 | Global API token | ✓ | — |
 | Personal API token | ✓ | ✓ |
 | Gallery stats overview (incl. user count) | ✓ | partial |
@@ -34,7 +35,8 @@ Regular users see **API**, **Gallery** in the nav; user menu: **Change password*
 
 - By default only admins create users; **allow registration** is an admin setting
 - Passwords hashed with scrypt
-- Web login requires a slider captcha (align the thumb with the gap)
+- Web login/register requires verification: local slider by default; admins can switch to Turnstile or Cap under **Settings → Access control**
+- If verification is misconfigured: `docker exec pichost slider` resets to the local slider
 - Login rate limiting
 
 ## Upload preferences & auto-delete