Add ALTCHA support (v1.2.0)

[capskip]

Adds ALTCHA to the Node SDK, following the same shape GeeTest v3 used.

ALTCHA is proof-of-work rather than recognition: the site issues a challenge and the client brute-forces a number that satisfies it. There is no image, audio or text to read, so a solve is deterministic and takes milliseconds.

API

// CapSkip fetches the challenge for you
const result = await solver.altcha('https://example.com/signup', {
  challengeUrl: 'https://example.com/captcha/api/altcha/challenge',
});

// ...or hand it the document you already have. No network request at all.
const result = await solver.altcha(url, { challengeJson: { algorithm: 'SHA-256', ... } });

result.token;    // the base64 payload for the site's `altcha` form field
result.number;   // the counter that solved it
result.code;     // the same string as token

Decisions worth reviewing

• challengeJson accepts an object, serialized for you — a form body would otherwise carry "[object Object]" and draw ERROR_BAD_PARAMETERS.
• Buffer.from(x, 'base64') is lenient — it drops invalid characters rather than throwing, so applyAltchaSolution round-trips the decode to confirm the input really was base64 before trusting it. Without that, a non-token answer would decode to garbage instead of being left alone.
• Both challenge params may be sent; the inline document wins. That matches CapSkip, which is deliberately more permissive here than 2Captcha's mutually-exclusive spelling.
• Uses defaultTimeout, not recaptchaTimeout. This is CPU work, not a browser solve.
• A proxy applies only to the challengeUrl fetch; an inline challenge never touches the network.

Testing

• 89 tests pass (npm test), up from 73 — new test/altcha.test.js plus integration tests driving real HTTP against the mock server, which now serves a genuine base64 ALTCHA payload so the decode path is actually exercised.
• types/index.d.ts compiles clean under tsc --strict; adds AltchaOptions and the token/number result fields.
• Verified end-to-end against a running CapSkip on :8080, on both the inline and the challengeUrl fetch paths, with a challenge whose answer was known in advance — the SDK recovered the exact counter each time.

Note for the MCP repo

capskip-mcp depends on this package and its ALTCHA tool needs capskip >= 1.2.0. Publish this release to npm before releasing capskip-mcp.