Add ALTCHA support (v1.2.0)

[capskip]

Adds ALTCHA to the PHP SDK, following the same shape GeeTest v3 used.

ALTCHA is proof-of-work rather than recognition: the site issues a challenge and the client brute-forces a number that satisfies it. There is no image, audio or text to read, so a solve is deterministic and takes milliseconds.

API

// CapSkip fetches the challenge for you
$result = $solver->altcha('https://example.com/signup', [
    'challenge_url' => 'https://example.com/captcha/api/altcha/challenge',
]);

// ...or hand it the document you already have. No network request at all.
$result = $solver->altcha($url, ['challenge_json' => ['algorithm' => 'SHA-256', ...]]);

$result['token'];    // the base64 payload for the site's `altcha` form field
$result['number'];   // the counter that solved it
$result['code'];     // the same string as token

AsyncCapSkip inherits it, as it does every other solve method.

Decisions worth reviewing

• Method named altcha(), not altchacaptcha(). 2captcha-php spells it altchacaptcha, but this SDK uses one house name across all five CapSkip SDKs (geetest, turnstile, recaptcha), and consistency won.
• challenge_json accepts an array, serialized for you — a form body would otherwise carry the string "Array" and draw ERROR_BAD_PARAMETERS.
• base64_decode($code, true) runs in strict mode, so an answer that is not a token leaves the result untouched rather than decoding to garbage.
• Both challenge params may be sent; the inline document wins. That matches CapSkip, which is deliberately more permissive here than 2Captcha's mutually-exclusive spelling.
• Uses defaultTimeout, not recaptchaTimeout. This is CPU work, not a browser solve.
• A proxy applies only to the challenge_url fetch; an inline challenge never touches the network.

Testing

• 94 tests, 159 assertions pass (vendor/bin/phpunit), up from 73 — new tests/AltchaTest.php plus integration tests driving real HTTP through the built-in-server router, which now serves a genuine base64 ALTCHA payload so the decode path is actually exercised.
• Verified end-to-end against a running CapSkip on :8080, on both the inline and the challenge_url fetch paths, with a challenge whose answer was known in advance — the SDK recovered the exact counter each time.