Seed orchestrator: remote nodes lease ranges and post results over HTTPS

- seed_nodes (hashed bearer tokens) and seed_ranges (planned ranges with
  lease, resume point and counts); migration …140.
- SeedOrchestrator: lease (oldest plan first, FOR UPDATE SKIP LOCKED; a
  lease without a batch for 15 min passes to the next node and resumes at
  next_id), batch (stores files and fragments, moves next_id), finish,
  release, plan (from below live indexing / the backfill / earlier plans
  down to N days back; takes over the group's backfill), status.
- Seed API under /api/v1/seed (lease, ranges/:id/batches|done|release,
  status) behind a node-token middleware; JSON bodies up to 64 MB after
  gzip.
- seed:node runs a node: no database or Redis, outgoing HTTPS only, N
  connections, gzip batches, retries for network errors and 5xx, drops a
  range on 409, gives its ranges back on SIGTERM. seed-node/ has a compose
  file that builds the image from this repository.
- seed:token, seed:plan, seed:status for the operator. Header parsing moved
  to lib/ingest and the range loop to lib/seed/runner, shared by seed:range
  and seed:node.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

database/migrations/1768620765140_seed_orchestrator.ts

@@ -0,0 +1,47 @@
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+/**
+ * The seed orchestrator (CONCEPT.md D38): nodes that lease article ranges
+ * over HTTPS and submit what they aggregated (D37), and the ranges planned
+ * for them. A range's id is its priority: plans insert newest first.
+ */
+export default class extends BaseSchema {
+  async up() {
+    this.schema.createTable('seed_nodes', (table) => {
+      table.increments('id')
+      table.text('name').notNullable().unique()
+      // sha256 of the bearer token; the token itself is shown once, when it's made.
+      table.string('token_hash', 64).notNullable().unique()
+      table.boolean('disabled').notNullable().defaultTo(false)
+      table.timestamp('created_at', { useTz: true }).notNullable().defaultTo(this.now())
+      table.timestamp('last_seen_at', { useTz: true }).nullable()
+    })
+
+    this.schema.createTable('seed_ranges', (table) => {
+      table.bigIncrements('id')
+      table.text('group_name').notNullable()
+      table.bigInteger('start_id').notNullable()
+      table.bigInteger('end_id').notNullable()
+      // First article not reported yet; a re-leased range resumes here.
+      table.bigInteger('next_id').notNullable()
+      table.string('status', 8).notNullable().defaultTo('queued')
+      table.integer('node_id').nullable().references('id').inTable('seed_nodes').onDelete('SET NULL')
+      table.integer('attempts').notNullable().defaultTo(0)
+      table.timestamp('leased_at', { useTz: true }).nullable()
+      table.timestamp('heartbeat_at', { useTz: true }).nullable()
+      table.timestamp('done_at', { useTz: true }).nullable()
+      table.bigInteger('headers').notNullable().defaultTo(0)
+      table.bigInteger('files').notNullable().defaultTo(0)
+      table.bigInteger('fragments').notNullable().defaultTo(0)
+      table.text('error').nullable()
+      table.timestamp('created_at', { useTz: true }).notNullable().defaultTo(this.now())
+      table.index(['group_name', 'start_id'])
+    })
+    this.schema.raw(`CREATE INDEX seed_ranges_open_idx ON seed_ranges (id) WHERE status IN ('queued', 'leased')`)
+  }
+
+  async down() {
+    this.schema.dropTable('seed_ranges')
+    this.schema.dropTable('seed_nodes')
+  }
+}

database/schema.ts

@@ -348,6 +348,60 @@ export class ReleaseSchema extends BaseModel {
   declare source: string | null
 }
 
+export class SeedNodeSchema extends BaseModel {
+  static $columns = ['createdAt', 'disabled', 'id', 'lastSeenAt', 'name', 'tokenHash'] as const
+  $columns = SeedNodeSchema.$columns
+  @column.dateTime({ autoCreate: true })
+  declare createdAt: DateTime
+  @column()
+  declare disabled: boolean
+  @column({ isPrimary: true })
+  declare id: number
+  @column.dateTime()
+  declare lastSeenAt: DateTime | null
+  @column()
+  declare name: string
+  @column()
+  declare tokenHash: string
+}
+
+export class SeedRangeSchema extends BaseModel {
+  static $columns = ['attempts', 'createdAt', 'doneAt', 'endId', 'error', 'files', 'fragments', 'groupName', 'headers', 'heartbeatAt', 'id', 'leasedAt', 'nextId', 'nodeId', 'startId', 'status'] as const
+  $columns = SeedRangeSchema.$columns
+  @column()
+  declare attempts: number
+  @column.dateTime({ autoCreate: true })
+  declare createdAt: DateTime
+  @column.dateTime()
+  declare doneAt: DateTime | null
+  @column()
+  declare endId: bigint | number
+  @column()
+  declare error: string | null
+  @column()
+  declare files: bigint | number
+  @column()
+  declare fragments: bigint | number
+  @column()
+  declare groupName: string
+  @column()
+  declare headers: bigint | number
+  @column.dateTime()
+  declare heartbeatAt: DateTime | null
+  @column({ isPrimary: true })
+  declare id: bigint | number
+  @column.dateTime()
+  declare leasedAt: DateTime | null
+  @column()
+  declare nextId: bigint | number
+  @column()
+  declare nodeId: number | null
+  @column()
+  declare startId: bigint | number
+  @column()
+  declare status: string
+}
+
 export class SfvEntrySchema extends BaseModel {
   static $columns = ['crc', 'name', 'postedAt', 'poster', 'releaseId'] as const
   $columns = SfvEntrySchema.$columns