fix(captcha): strip reasoning-model <think> blocks before json extraction

Reasoning models prefix responses with <think>...</think> (or
<thinking>...</thinking>) scratchpad that can itself contain a JSON-looking
object. The brace-counting extractor would grab that inner object instead of
the real answer. Strip think/thinking blocks via a package-level regexp before
the balanced-object scan. Adds table cases covering both tag spellings while
keeping the plain, prose-wrapped, and unbalanced cases intact.

internal/captcha/json.go

@@ -1,13 +1,24 @@
 package captcha
 
-import "strings"
+import (
+	"regexp"
+	"strings"
+)
+
+// thinkRe matches reasoning-model scratchpad blocks (<think>…</think> or
+// <thinking>…</thinking>). These can themselves contain JSON-looking objects,
+// so they are stripped before the brace scan to avoid grabbing the wrong object.
+var thinkRe = regexp.MustCompile(`(?s)<think(?:ing)?>.*?</think(?:ing)?>`)
 
 // extractJSON returns the first balanced {...} object found in s, or s unchanged
 // if no opening brace is present. It scans by brace depth so prose, markdown
 // fences, or an example object before the real one do not corrupt parsing.
+// Reasoning-model <think>…</think> blocks are stripped first so a JSON-looking
+// object inside the scratchpad is not mistaken for the answer.
 // Note: it does not account for braces inside string literals; that is
 // acceptable for the short, structured captcha responses this handles.
 func extractJSON(s string) string {
+	s = thinkRe.ReplaceAllString(s, "")
 	start := strings.IndexByte(s, '{')
 	if start < 0 {
 		return s