Seeding nodes log in before leasing; TLS through tunnels

- seed:node logs in to NNTP before taking a range and keeps the connection
  across ranges (replaced after 2 minutes idle or a failed range). A node
  that can't reach its news server takes no range: two ranges were set
  aside as failed while an office node's tunnel was being set up
  (ECONNREFUSED 127.0.0.1:1563, five leases each). After an IP-address
  limit refusal it waits 5 minutes.
- NNTP_TLS_SERVERNAME: the hostname the TLS certificate is checked
  against when NNTP_HOST is a tunnel ("Hostname/IP does not match
  certificate's altnames: Host: localhost").
- seed-node/README: the IP-address limit and tunnelling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/nntp.ts

@@ -10,4 +10,6 @@ export default {
   poolSize: env.get('NNTP_POOL_SIZE', 10),
   /** A command without an answer this long counts as a dead connection (XOVER of 20k headers takes ~0.2 s). */
   commandTimeoutMs: env.get('NNTP_COMMAND_TIMEOUT_MS', 120_000),
+  /** TLS certificate hostname when NNTP_HOST is a tunnel (seeding nodes; lib/nntp/xover_client). */
+  tlsServername: env.get('NNTP_TLS_SERVERNAME'),
 }