feat: enhance player login process with captcha validation and improve wallet display logic

- Added captcha validation to the player login screen, requiring users to input a captcha code for authentication.
- Implemented a new API call to fetch captcha images, improving security during login.
- Updated wallet display logic to ensure accurate representation of available and total balances based on player funding modes.
- Enhanced documentation in AGENTS.md to clarify changes in credit flow and login requirements.

AGENTS.md

@@ -10,6 +10,8 @@ This version has breaking changes — APIs, conventions, and file structure may
 
 ## Learned Workspace Facts
 
-- 信用盘流水对外类型：`win_credit`（中奖释额）、`bill_settlement`（账期收付），与钱包 `prize`/派彩文案分离。
-- 信用流水结余：`game_settlement_win`/`settlement_confirm`/`bet_hold_release` 会减 `used_credit` 并倒推结余；`settlement_payout`（账期收付）仅记账，`affects_available_credit: false`。
+- 彩票端账号密码登录须图形验证码（后端校验 + 登录页）；勿在 SSR 渲染验证码文案（hydration 不一致）。
+- 信用盘流水对外类型：`win_credit`（中奖释额）、`bill_settlement`（账期收付）、`reversal` 含 `game_settlement_reversal`，与钱包 `prize`/派彩文案分离。
+- 信用流水结余：`game_settlement_win`/`settlement_confirm`/`bet_hold_release`/`game_settlement_reversal` 会减 `used_credit` 并倒推结余；`settlement_payout`（账期收付）仅记账，`affects_available_credit: false`；分页 `balance_after` 须跳过前置页累计。
+- 账号密码登录：`lottery-auth.ts` 与 `player-session-store` 须在**模块加载时**从 `sessionStorage` 同步恢复 Bearer（子组件 `useEffect` 早于 `HydratePlayerAuth`，否则刷新 `/hall` 会先 401）。
 - Token 进场（`EntryGate`）：`entryLifecycleRef`（idle→running→done）防 URL token 剥离或 store 写入后重复触发 `doEntry` 导致成功/失败页闪现；成功后直接 `router.replace('/hall')`。