Seeding nodes lease first, connect for the lease, close when idle

A failed NNTP login gives the range back uncounted (no attempt used), and a
node with nothing to lease holds no connection. Replaces log-in-before-lease,
which kept idle connections and logged in again every minute while idle.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/functional/seed_api.spec.ts

@@ -88,4 +88,15 @@ test.group('Seed API', (group) => {
     }
     ;(await client.post('/api/v1/seed/lease').headers({ authorization: `Bearer ${token}` })).assertStatus(200)
   })
+
+  test('a range given back before it started does not use up an attempt', async ({ client, assert }) => {
+    const token = await SeedOrchestrator.issueToken('no-news-server')
+    await db.table('seed_ranges').insert({ group_name: 'alt.binaries.test', start_id: 1, end_id: 100, next_id: 1 })
+    const auth = { authorization: `Bearer ${token}` }
+    const range = (await client.post('/api/v1/seed/lease').headers(auth)).body().range
+    ;(await client.post(`/api/v1/seed/ranges/${range.id}/release`).headers(auth).json({ error: 'NNTP login: 502', uncounted: true })).assertStatus(200)
+    const row = await db.from('seed_ranges').where('id', range.id).first()
+    assert.equal(row.status, 'queued')
+    assert.equal(row.attempts, 0)
+  })
 })