Seeding nodes log in before leasing; TLS through tunnels

- seed:node logs in to NNTP before taking a range and keeps the connection
  across ranges (replaced after 2 minutes idle or a failed range). A node
  that can't reach its news server takes no range: two ranges were set
  aside as failed while an office node's tunnel was being set up
  (ECONNREFUSED 127.0.0.1:1563, five leases each). After an IP-address
  limit refusal it waits 5 minutes.
- NNTP_TLS_SERVERNAME: the hostname the TLS certificate is checked
  against when NNTP_HOST is a tunnel ("Hostname/IP does not match
  certificate's altnames: Host: localhost").
- seed-node/README: the IP-address limit and tunnelling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/nntp/xover_client.ts

@@ -8,6 +8,8 @@ export interface XoverClientOptions {
   user?: string
   password?: string
   secure?: boolean
+  /** Hostname the TLS certificate must match, when connecting through a tunnel (default: host). */
+  servername?: string
   /** A command whose reply stalls this long fails, and the connection with it. */
   timeoutMs?: number
   /** Ask for gzip-compressed overview data (XFEATURE COMPRESS GZIP), when the server has it. */
@@ -58,7 +60,7 @@ export class XoverClient {
 
   static async connect(options: XoverClientOptions): Promise<XoverClient> {
     const sock = options.secure
-      ? tls.connect({ host: options.host, port: options.port, servername: options.host })
+      ? tls.connect({ host: options.host, port: options.port, servername: options.servername || options.host })
       : net.connect({ host: options.host, port: options.port })
     const client = new XoverClient(sock, options.timeoutMs ?? 120_000)
     sock.setTimeout(client.timeoutMs)