- Implemented across bootstrap.php, chat frontend, and dashboard:

Per-tier audio bitrate: Free 64, Plus 96, Pro 128 kbps.
Configurable text/voice reply threads and depth.
Registration/login-only honeypot and internal CAPTCHA.
Optional Google reCAPTCHA v2/v3 with server verification.
Archive/export support for replies and bitrate.
Dashboard controls for all settings.
Verified JavaScript, JSON, SQLite migrations, desktop/mobile UI, and 
browser console. Native PHP lint was unavailable because PHP is not 
installed.
Google implementation follows Siteverify and reCAPTCHA v3.

config.json

@@ -10,6 +10,8 @@
     "poll_max_backoff_ms": 15000,
     "messages_per_page": 100,
     "max_rendered_messages": 500,
+    "replies_enabled": true,
+    "reply_max_depth": 4,
     "session_lock_ip": true,
     "session_lock_cookie": true,
     "allow_guest": false
@@ -57,7 +59,28 @@
     "max_login_attempts": 10,
     "session_timeout_hours": 24,
     "bcrypt_cost": 10,
-    "allowed_origins": []
+    "allowed_origins": [],
+    "captcha": {
+      "registration_enabled": true,
+      "login_enabled": true,
+      "honeypot": {
+        "enabled": true
+      },
+      "internal": {
+        "enabled": true,
+        "difficulty": "easy",
+        "ttl_seconds": 300,
+        "max_attempts": 3
+      },
+      "google": {
+        "enabled": false,
+        "version": "v2",
+        "site_key": "",
+        "secret_key": "",
+        "v3_min_score": 0.5,
+        "hostname": ""
+      }
+    }
   },
   "subscriptions": {
     "enabled": true