fix: normalize captcha display text to lowercase when case_sensitive is false

[Copilot]

When case_sensitive = false (the default), the captcha image could render mixed-case text like AbCdEf while silently accepting ABCDEF — technically correct but visually misleading, since the image implies a specific casing that isn't enforced.

Changes

• TextGenerator::generate() — sets question (rendered in image) to mb_strtolower($text) when caseSensitive is false; answer remains the original text and flows through the existing normalize() path unchanged

return new CaptchaChallenge(
    id: bin2hex(random_bytes(16)),
    question: $caseSensitive ? $text : mb_strtolower($text),
    answer: $text,
    caseSensitive: $caseSensitive,
);

• CaptchaGenerationTest — adds coverage for:
  • displayed text is lowercase when case_sensitive = false
  • original casing preserved in image when case_sensitive = true (uses a fixed all-uppercase character pool to avoid flakiness)
  • all-caps input accepted when insensitive; wrong-case rejected when sensitive