fix: include ALTCHA signature in verify payload; case-insensitive variant filter

- squid.js: add top-level signature from challenge response to verify payload
  (server added signature validation, causing HTTP 400 without it)
- ytdlp.js: switch variant filter from !*= to !~= (?i) so Remix/REMIX/remix
  are all rejected, not just lowercase

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/lib/ytdlp.js

@@ -28,18 +28,19 @@ function buildTitleKeywords(title) {
 
 function buildVariantFilter(title) {
   const t = (title || '').toLowerCase();
+  // !~= (?i) is yt-dlp's case-insensitive "does not match regex" — catches Remix/REMIX/remix etc.
   const RULES = [
-    { key: 'sped',         expr: 'title !*= sped' },
-    { key: 'speedup',      expr: 'title !*= speedup' },
-    { key: 'slowed',       expr: 'title !*= slowed' },
-    { key: 'reverb',       expr: 'title !*= reverb' },
-    { key: 'nightcore',    expr: 'title !*= nightcore' },
-    { key: 'karaoke',      expr: 'title !*= karaoke' },
-    { key: 'parody',       expr: 'title !*= parody' },
-    { key: 'remix',        expr: 'title !*= remix' },
-    { key: 'cover',        expr: 'title !*= cover' },
-    { key: 'acoustic',     expr: 'title !*= acoustic' },
-    { key: 'instrumental', expr: 'title !*= instrumental' },
+    { key: 'sped',         expr: 'title !~= (?i)sped up' },
+    { key: 'speedup',      expr: 'title !~= (?i)speed\\s*up' },
+    { key: 'slowed',       expr: 'title !~= (?i)slowed' },
+    { key: 'reverb',       expr: 'title !~= (?i)reverb' },
+    { key: 'nightcore',    expr: 'title !~= (?i)nightcore' },
+    { key: 'karaoke',      expr: 'title !~= (?i)karaoke' },
+    { key: 'parody',       expr: 'title !~= (?i)parody' },
+    { key: 'remix',        expr: 'title !~= (?i)remix' },
+    { key: 'cover',        expr: 'title !~= (?i)cover' },
+    { key: 'acoustic',     expr: 'title !~= (?i)acoustic' },
+    { key: 'instrumental', expr: 'title !~= (?i)instrumental' },
   ];
   const parts = RULES.filter(r => !t.includes(r.key)).map(r => r.expr);
   return parts.length ? parts.join(' & ') : '';