Seed orchestrator: remote nodes lease ranges and post results over HTTPS

- seed_nodes (hashed bearer tokens) and seed_ranges (planned ranges with
  lease, resume point and counts); migration …140.
- SeedOrchestrator: lease (oldest plan first, FOR UPDATE SKIP LOCKED; a
  lease without a batch for 15 min passes to the next node and resumes at
  next_id), batch (stores files and fragments, moves next_id), finish,
  release, plan (from below live indexing / the backfill / earlier plans
  down to N days back; takes over the group's backfill), status.
- Seed API under /api/v1/seed (lease, ranges/:id/batches|done|release,
  status) behind a node-token middleware; JSON bodies up to 64 MB after
  gzip.
- seed:node runs a node: no database or Redis, outgoing HTTPS only, N
  connections, gzip batches, retries for network errors and 5xx, drops a
  range on 409, gives its ranges back on SIGTERM. seed-node/ has a compose
  file that builds the image from this repository.
- seed:token, seed:plan, seed:status for the operator. Header parsing moved
  to lib/ingest and the range loop to lib/seed/runner, shared by seed:range
  and seed:node.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/middleware/seed_node_middleware.ts

@@ -0,0 +1,26 @@
+import type { HttpContext } from '@adonisjs/core/http'
+import type { NextFn } from '@adonisjs/core/types/http'
+import SeedOrchestrator from '#services/SeedOrchestrator'
+
+declare module '@adonisjs/core/http' {
+  interface HttpContext {
+    /** The seeding node that made this request (CONCEPT.md D38). */
+    seedNode: { id: number; name: string }
+  }
+}
+
+/**
+ * Seed API requests carry a node's bearer token (`node ace seed:token
+ * <name>`); anything else gets 401. The seed API is the only part of the app
+ * reachable from the internet (traefik routes only /api/v1/seed there).
+ */
+export default class SeedNodeMiddleware {
+  async handle(ctx: HttpContext, next: NextFn) {
+    const header = ctx.request.header('authorization') ?? ''
+    const token = header.startsWith('Bearer ') ? header.slice(7).trim() : ''
+    const node = token ? await SeedOrchestrator.nodeForToken(token) : null
+    if (!node) return ctx.response.unauthorized({ error: 'Unknown or disabled seed node token' })
+    ctx.seedNode = node
+    return next()
+  }
+}