fix: word-boundary variant filter; reattempt ALTCHA verify payload structure

- ytdlp.js: use \b word boundaries in all variant filter regexes so that
  partial matches like "nightcoreals" containing "nightcore" no longer
  falsely reject official videos; also fixes sped regression (!~= \bsped\b
  instead of the too-narrow "sped up" pattern)
- squid.js: restructure verify payload to mirror challenge response layout
  { parameters, solution: { number, derivedKey }, signature }

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/lib/squid.js

@@ -106,8 +106,13 @@ async function getAltchaCookie() {
   // 2. Solve PoW
   const solution = await solveAltcha(challenge);
 
-  // 3. Verify — include the top-level signature so the server can authenticate the challenge
-  const payload = Buffer.from(JSON.stringify({ challenge, solution, signature: chBody.signature })).toString('base64');
+  // 3. Verify — mirror the challenge response structure: { parameters, signature } + solution fields
+  const verifyBody = {
+    parameters: challenge,
+    solution:   { number: solution.counter, derivedKey: solution.derivedKey },
+    signature:  chBody.signature,
+  };
+  const payload = Buffer.from(JSON.stringify(verifyBody)).toString('base64');
   const vRes = await httpsPost(`${SQUID_BASE}/api/altcha/verify`, { payload });
   if (vRes.status !== 200) throw new Error(`ALTCHA verify HTTP ${vRes.status}`);