fix: unwrap ALTCHA challenge .parameters wrapper before solving PoW

The /api/altcha/challenge response is { parameters: { nonce, salt, ... } }.
Destructuring the top level left nonce/salt/keyPrefix as undefined, causing
Buffer.from(undefined) crash on every squid.wtf download attempt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/lib/squid.js

@@ -97,15 +97,16 @@ function httpsPost(url, body, extraHeaders) {
 async function getAltchaCookie() {
   if (_captchaCookie && Date.now() - _captchaAt < CAPTCHA_TTL) return _captchaCookie;
 
-  // 1. Fetch challenge
+  // 1. Fetch challenge — response may wrap params in a "parameters" key
   const chRes = await httpsGet(`${SQUID_BASE}/api/altcha/challenge`);
   if (chRes.status !== 200) throw new Error(`ALTCHA challenge HTTP ${chRes.status}`);
-  const challenge = JSON.parse(chRes.body);
+  const chBody    = JSON.parse(chRes.body);
+  const challenge = chBody.parameters ?? chBody; // unwrap { parameters: {...} } if present
 
   // 2. Solve PoW
   const solution = await solveAltcha(challenge);
 
-  // 3. Verify — server sets captcha_verified_at cookie
+  // 3. Verify — payload contains the unwrapped challenge params + our solution
   const payload = Buffer.from(JSON.stringify({ challenge, solution })).toString('base64');
   const vRes = await httpsPost(`${SQUID_BASE}/api/altcha/verify`, { payload });
   if (vRes.status !== 200) throw new Error(`ALTCHA verify HTTP ${vRes.status}`);