Spots: the spotter and the spot inspector, passwords kept apart

Two processes, one NNTP connection each (the coordinator 40 -> 38):
- spots:read (service spotter): free.pt's overviews after the last article
  seen, each spot's full header verified (lib/spotnet from voyager 1, as
  Spotweb), its description, website and NZB articles; the password its
  title or text names; delete/dispose messages applied.
- spots:inspect (service spot-inspector): each spot's compressed NZB read,
  its files listed (spot_files), each matched to the header pass's release
  by the same release identity in one of its groups within 48 h
  (release_spots); unmatched spots matched again hourly, after 24 h a
  release of their own (source spot) with the spot's NZB.
- release_passwords: per release and password, its source (nzb, spot-title,
  spot-text) and spot; the catalog keeps only passworded.
XoverClient.head(); PROBE_CONNECTIONS default 10.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/nntp/xover_client.ts

@@ -246,6 +246,20 @@ export class XoverClient {
     })
   }
 
+  /**
+   * An article's header by message-id, raw (as body(): "\r\n.\r\n" cut off). Spot headers carry the spot's XML
+   * (X-XML), signed (lib/spotnet). 430 (no such article) throws MissingArticle.
+   */
+  async head(messageId: string): Promise<Buffer> {
+    return this.timed(async () => {
+      const id = messageId.startsWith('<') ? messageId : `<${messageId}>`
+      const reply = await this.command(`HEAD ${id}`)
+      if (reply.startsWith('430') || reply.startsWith('423')) throw new MissingArticle(reply)
+      await this.expect(reply, ['221'])
+      return this.rawBody()
+    })
+  }
+
   /**
    * Several bodies, pipelined: every BODY is sent at once and the replies read in order, so one round trip
    * covers them all (one at a time, a connection waited ~0.1–2 s per article: 3–10 articles/s on 6; LOG.md