Seeding nodes log in before leasing; TLS through tunnels

- seed:node logs in to NNTP before taking a range and keeps the connection
  across ranges (replaced after 2 minutes idle or a failed range). A node
  that can't reach its news server takes no range: two ranges were set
  aside as failed while an office node's tunnel was being set up
  (ECONNREFUSED 127.0.0.1:1563, five leases each). After an IP-address
  limit refusal it waits 5 minutes.
- NNTP_TLS_SERVERNAME: the hostname the TLS certificate is checked
  against when NNTP_HOST is a tunnel ("Hostname/IP does not match
  certificate's altnames: Host: localhost").
- seed-node/README: the IP-address limit and tunnelling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

seed-node/node.env.example

@@ -10,6 +10,9 @@ NNTP_PORT=563
 NNTP_SECURE=true
 NNTP_USER=replace_me
 NNTP_PASSWORD=replace_me
+# Only when NNTP_HOST is a tunnel or proxy (e.g. localhost:1563 forwarded to news.eweka.nl:563):
+# the hostname the server's TLS certificate is for.
+# NNTP_TLS_SERVERNAME=news.eweka.nl
 
 # --- Required by the app's configuration, but unused on a seeding node (no database, Redis or web server).
 NODE_ENV=production