[flthibaud]

Two linked problems in the anti-bot ladder.

Sidecar answers were never checked (#48). A page returned by the browser sidecar went straight to readability: no status check, no detectChallenge. If the browser also ended on the block page, it was stored as the article.

• Both solver.fetch call sites now return errChallenge unless the status is 2xx and detectChallenge finds nothing.

Ordinary Cloudflare pages looked like challenges (#29). /cdn-cgi/challenge-platform/ was a marker, but Cloudflare's passive jsd script puts that path into normal 200 pages. With the new check above, a page the browser really solved would have been thrown away, so both are fixed together.

• The marker is replaced by _cf_chl_opt, which only real interstitials carry.

Tests: the existing 200-interstitial case now uses a real interstitial body; new cases for a large article carrying the jsd script (challengeNone), a sidecar article carrying it (returned as the page), and a sidecar block page (403 and 200 interstitial, both errChallenge).

Tested with gofmt, go vet ./... and go test -race ./... against a migrated postgres:16 (no test skipped).

Closes #48
Closes #29

[flthibaud]

Review: OK to merge.

• Code and tests by Mistral. Its first version only added the sidecar check; I sent it back because detectChallenge still had the Cloudflare's passive JS-detection script makes normal articles look like challenges #29 false positive, which would have made the solver reject real Cloudflare pages. The second version fixes Cloudflare's passive JS-detection script makes normal articles look like challenges #29 in the same branch.
• On the pre-emptive sidecar path (host already marked as challenged), a rejected answer now returns errChallenge at once instead of trying the normal clients. That matches what the article would have got anyway on a host known to gate everything.
• Not checked: the third acceptance point of Cloudflare's passive JS-detection script makes normal articles look like challenges #29 (a real korben.info article). No live fetch was made; the test uses a synthetic page with the same script tag.