Seed relay: nodes get their headers through the seed API

The seed API keeps a pool of NNTP connections (SEED_NNTP_CONNECTIONS) and
serves GET /api/v1/seed/ranges/:id/chunk?from=&to= for leased ranges:
the gzip stream the news server sent, passed on unopened. seed:node fetches
that way by default (SEED_FETCH=relay), so a node needs only a token and
SEED_CONNECTIONS; SEED_FETCH=direct keeps its own NNTP connections. All
fetching then comes from the indexer's IP (the account allows two).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

seed-node/node.env.example

@@ -1,17 +1,19 @@
 # --- Seed API: the orchestrator, and this node's token (`node ace seed:token <name>` on the indexer).
 SEED_URL=https://seed.exp.sforum.nl
 SEED_TOKEN=sn_replace_me
-# Ranges worked on at once; each uses one NNTP connection of the account below.
-SEED_CONNECTIONS=2
+# Ranges worked on at once (about 0.4 CPU core each).
+SEED_CONNECTIONS=4
+# relay: headers come through the seed API, no news server account needed (the default).
+# direct: the node fetches with its own NNTP account; then fill in the NNTP_* lines below.
+SEED_FETCH=relay
 
-# --- NNTP account this node fetches headers with (mind its connection limit across all nodes).
-NNTP_HOST=news.example.com
+# --- Only for SEED_FETCH=direct: the NNTP account (counts against its connection and IP limits).
+NNTP_HOST=localhost
 NNTP_PORT=563
 NNTP_SECURE=true
-NNTP_USER=replace_me
-NNTP_PASSWORD=replace_me
-# Only when NNTP_HOST is a tunnel or proxy (e.g. localhost:1563 forwarded to news.eweka.nl:563):
-# the hostname the server's TLS certificate is for.
+NNTP_USER=unused
+NNTP_PASSWORD=unused
+# Through a tunnel or proxy: the hostname the server's TLS certificate is for.
 # NNTP_TLS_SERVERNAME=news.eweka.nl
 
 # --- Required by the app's configuration, but unused on a seeding node (no database, Redis or web server).