Enhance verification system with multi-provider support and alt-account detection

- Added support for multiple captcha providers including Google reCAPTCHA (v2 and v3), hCaptcha, and Cloudflare Turnstile.
- Introduced new fields in the verification configuration for selecting captcha providers and enabling alt-account detection.
- Implemented logic to handle verification attempts and flag potential alt accounts based on IP and invite code analysis.
- Updated environment configuration to include necessary keys for captcha providers.
- Enhanced the user interface to allow selection of captcha providers in the verification setup.
- Improved backend handling of verification records to store additional data related to captcha provider usage.

docs/PHASE-TRACKING.md

@@ -220,6 +220,30 @@
 - Premium-Zahlungsanbindung
 - P4-UX (Server-Lock, Ban deleteMessageSeconds) bewusst nachgelagert
 
+## Post-Phase – Verification Captcha-Anbieter + Alt-Erkennung (Status: implementiert)
+
+### Abgeschlossen (Code)
+
+- Captcha-Anbieter wählbar pro Guild: `MATH`, `RECAPTCHA_V2`, `RECAPTCHA_V3`, `HCAPTCHA`, `TURNSTILE`
+- Google/hCaptcha/Turnstile Keys in `.env` (WebUI); Dashboard zeigt nur konfigurierte Anbieter
+- Captcha-Seite `/verify/captcha` mit Provider-Widgets; Server-side Siteverify
+- Alt-Account-Erkennung: gesalzener IP-Hash (Captcha-Flow) + Invite-Cluster; optional blockieren via `failAction`
+- Prisma `VerificationRecord` + Config-Felder; Migration `20260723120000_verification_captcha_alt`
+- Slash `/verify setup`: `captcha_provider`, `alt_detection`
+
+### Manuell testen
+
+- [ ] `.env`: `RECAPTCHA_SITE_KEY`/`SECRET` setzen → Dashboard zeigt reCAPTCHA v2/v3
+- [ ] Guild Captcha-Modus + Anbieter wählen → Verify-Button → WebUI Captcha → Rolle
+- [ ] Alt-Erkennung an: zweiter Account gleiche IP → Kick/Ban je nach failAction
+- [ ] Migration: `prisma migrate deploy` + Bot/WebUI neu bauen
+- [ ] `CAPTCHA_IP_HASH_SALT` gesetzt (min. 16 Zeichen), sonst keine IP-Alt-Signale
+
+### Bewusst offen
+
+- Kein Browser-Fingerprinting (DSGVO); IP nur gehasht mit Salt
+- Keine manuelle „Alt freigeben“-UI (nur Flag in `VerificationRecord`)
+
 ## Nächster geplanter Schritt
 
 - Deploy auf Traefik-Server manuell verifizieren; danach ggf. `deploy` → `main` mergen (nur auf Freigabe).