Seeding nodes log in before leasing; TLS through tunnels

- seed:node logs in to NNTP before taking a range and keeps the connection
  across ranges (replaced after 2 minutes idle or a failed range). A node
  that can't reach its news server takes no range: two ranges were set
  aside as failed while an office node's tunnel was being set up
  (ECONNREFUSED 127.0.0.1:1563, five leases each). After an IP-address
  limit refusal it waits 5 minutes.
- NNTP_TLS_SERVERNAME: the hostname the TLS certificate is checked
  against when NNTP_HOST is a tunnel ("Hostname/IP does not match
  certificate's altnames: Host: localhost").
- seed-node/README: the IP-address limit and tunnelling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

start/env.ts

@@ -48,6 +48,7 @@ export default await Env.create(new URL('../', import.meta.url), {
   NNTP_SECURE: Env.schema.boolean(),
   NNTP_POOL_SIZE: Env.schema.number.optional(),
   NNTP_COMMAND_TIMEOUT_MS: Env.schema.number.optional(),
+  NNTP_TLS_SERVERNAME: Env.schema.string.optional(),
 
   // Indexer (config/indexer.ts)
   BACKFILL_MAX_QUEUED: Env.schema.number.optional(),