fix: include ALTCHA signature in verify payload; case-insensitive variant filter

- squid.js: add top-level signature from challenge response to verify payload
  (server added signature validation, causing HTTP 400 without it)
- ytdlp.js: switch variant filter from !*= to !~= (?i) so Remix/REMIX/remix
  are all rejected, not just lowercase

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/lib/squid.js

@@ -106,8 +106,8 @@ async function getAltchaCookie() {
   // 2. Solve PoW
   const solution = await solveAltcha(challenge);
 
-  // 3. Verify — payload contains the unwrapped challenge params + our solution
-  const payload = Buffer.from(JSON.stringify({ challenge, solution })).toString('base64');
+  // 3. Verify — include the top-level signature so the server can authenticate the challenge
+  const payload = Buffer.from(JSON.stringify({ challenge, solution, signature: chBody.signature })).toString('base64');
   const vRes = await httpsPost(`${SQUID_BASE}/api/altcha/verify`, { payload });
   if (vRes.status !== 200) throw new Error(`ALTCHA verify HTTP ${vRes.status}`);