v1.2.1 - Playwright Bot Detection & PoW Hardening

What's Changed

Security Fixes

• Server-side challenge timing: Detects instant PoW solves using un-spoofable server timestamps (serverElapsed < 1500ms → flagged)
• PoW now mandatory: Missing PoW solution triggers hard-fail (score 0.9, confidence 0.95) — previously only scored 0.5/0.6
• Tightened accessibility exemptions: touchEvents >= 3 (was > 0) and keyEvents >= 2 (was > 0) to prevent trivial spoofing

New Detection

• Playwright-specific client detection: New _detectPlaywright() checks for __pw*/__playwright* globals, deleted/configurable webdriver property, and missing chrome.runtime
• Server-side Playwright scoring: playwright_globals (0.95), webdriver_deleted (0.8), webdriver_configurable (0.7), chrome_runtime_missing (0.6)

Go Server

• Wired up /api/pow/challenge endpoint (was missing)
• VerifyWithHeaders() now accepts and processes PoW solutions
• Fixed pre-existing missing fmt import in detection.go

Weight Rebalancing

Category	Before	After
bot	0.10	0.15
rate_limit	0.05	0.01
tor_vpn	0.02	0.01

Tests

• 9 new tests (69 total, all passing)
• Covers: Playwright detection, missing PoW hard-fail, tightened touch/keyboard exemptions

Full Changelog: v1.2.0...v1.2.1