Seed orchestrator: remote nodes lease ranges and post results over HTTPS

- seed_nodes (hashed bearer tokens) and seed_ranges (planned ranges with
  lease, resume point and counts); migration …140.
- SeedOrchestrator: lease (oldest plan first, FOR UPDATE SKIP LOCKED; a
  lease without a batch for 15 min passes to the next node and resumes at
  next_id), batch (stores files and fragments, moves next_id), finish,
  release, plan (from below live indexing / the backfill / earlier plans
  down to N days back; takes over the group's backfill), status.
- Seed API under /api/v1/seed (lease, ranges/:id/batches|done|release,
  status) behind a node-token middleware; JSON bodies up to 64 MB after
  gzip.
- seed:node runs a node: no database or Redis, outgoing HTTPS only, N
  connections, gzip batches, retries for network errors and 5xx, drops a
  range on 409, gives its ranges back on SIGTERM. seed-node/ has a compose
  file that builds the image from this repository.
- seed:token, seed:plan, seed:status for the operator. Header parsing moved
  to lib/ingest and the range loop to lib/seed/runner, shared by seed:range
  and seed:node.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

seed-node/README.md

@@ -0,0 +1,26 @@
+# Seeding node
+
+A seeding node indexes old article ranges for the indexer (CONCEPT.md D37,
+D38). It asks the seed API for a range over HTTPS, fetches that range's
+headers over its own NNTP connections, groups them into files, and posts the
+result back. It only makes outgoing connections: no port forwarding, database
+or Redis.
+
+On the indexer (homelab):
+
+    docker compose exec web node ace seed:token my-server         # prints the node's token once
+    docker compose exec web node ace seed:plan alt.binaries.ath --days 365
+    docker compose exec web node ace seed:status
+
+On the node (any machine with Docker):
+
+    cp node.env.example node.env     # SEED_TOKEN, NNTP account, SEED_CONNECTIONS
+    docker compose up -d --build
+    docker compose logs -f
+
+`docker compose stop` gives the node's ranges back; a node that disappears
+loses its ranges to other nodes after 15 minutes without a batch. Updating:
+`docker compose up -d --build` again.
+
+Mind the NNTP account's connection limit: every node's SEED_CONNECTIONS
+count against it, next to the indexer's own connections.

seed-node/compose.yaml

@@ -0,0 +1,18 @@
+# A seeding node (CONCEPT.md D38): leases article ranges from the seed API over
+# HTTPS, indexes their headers over its own NNTP connections, and posts the
+# results back. Outgoing connections only. Builds the indexer image straight
+# from the git repository.
+#
+#   cp node.env.example node.env   # fill in SEED_TOKEN and the NNTP account
+#   docker compose up -d --build
+name: usenet-seed-node
+
+services:
+  seed-node:
+    build: https://gitea.exp.sforum.nl/daan/usenet-indexer.git#master
+    image: usenet-seed-node:latest
+    command: ["node", "ace", "seed:node"]
+    env_file: node.env
+    restart: unless-stopped
+    # On SIGTERM the node gives its ranges back (resumed from the last batch elsewhere).
+    stop_grace_period: 60s

seed-node/node.env.example

@@ -0,0 +1,29 @@
+# --- Seed API: the orchestrator, and this node's token (`node ace seed:token <name>` on the indexer).
+SEED_URL=https://seed.exp.sforum.nl
+SEED_TOKEN=sn_replace_me
+# Ranges worked on at once; each uses one NNTP connection of the account below.
+SEED_CONNECTIONS=2
+
+# --- NNTP account this node fetches headers with (mind its connection limit across all nodes).
+NNTP_HOST=news.example.com
+NNTP_PORT=563
+NNTP_SECURE=true
+NNTP_USER=replace_me
+NNTP_PASSWORD=replace_me
+
+# --- Required by the app's configuration, but unused on a seeding node (no database, Redis or web server).
+NODE_ENV=production
+TZ=UTC
+PORT=3333
+HOST=0.0.0.0
+LOG_LEVEL=info
+APP_KEY=unused-on-seed-nodes-unused-on-seed-nodes
+APP_URL=http://localhost:3333
+SESSION_DRIVER=memory
+DB_CONNECTION=pg
+DB_HOST=localhost
+DB_PORT=5432
+DB_USER=unused
+DB_DATABASE=unused
+REDIS_HOST=localhost
+REDIS_PORT=6379