Seed orchestrator: remote nodes lease ranges and post results over HTTPS

- seed_nodes (hashed bearer tokens) and seed_ranges (planned ranges with
  lease, resume point and counts); migration …140.
- SeedOrchestrator: lease (oldest plan first, FOR UPDATE SKIP LOCKED; a
  lease without a batch for 15 min passes to the next node and resumes at
  next_id), batch (stores files and fragments, moves next_id), finish,
  release, plan (from below live indexing / the backfill / earlier plans
  down to N days back; takes over the group's backfill), status.
- Seed API under /api/v1/seed (lease, ranges/:id/batches|done|release,
  status) behind a node-token middleware; JSON bodies up to 64 MB after
  gzip.
- seed:node runs a node: no database or Redis, outgoing HTTPS only, N
  connections, gzip batches, retries for network errors and 5xx, drops a
  range on 409, gives its ranges back on SIGTERM. seed-node/ has a compose
  file that builds the image from this repository.
- seed:token, seed:plan, seed:status for the operator. Header parsing moved
  to lib/ingest and the range loop to lib/seed/runner, shared by seed:range
  and seed:node.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

start/kernel.ts

@@ -47,4 +47,5 @@ router.use([
  */
 export const middleware = router.named({
   auth: () => import('#middleware/auth_middleware'),
+  seedNode: () => import('#middleware/seed_node_middleware'),
 })

start/routes.ts

@@ -13,6 +13,7 @@ import { controllers } from '#generated/controllers'
 
 const ReleasesController = () => import('#controllers/releases_controller')
 const NewznabController = () => import('#controllers/newznab_controller')
+const SeedController = () => import('#controllers/seed_controller')
 
 // Newznab API for Prowlarr / Sonarr / Radarr ("Generic Newznab", API path /api).
 router.get('/api', [NewznabController, 'handle'])
@@ -48,3 +49,15 @@ router
       .use(middleware.auth())
   })
   .prefix('/api/v1')
+
+// Seed API for remote seeding nodes (CONCEPT.md D38); the only routes traefik exposes publicly.
+router
+  .group(() => {
+    router.post('lease', [SeedController, 'lease'])
+    router.post('ranges/:id/batches', [SeedController, 'batch']).where('id', router.matchers.number())
+    router.post('ranges/:id/done', [SeedController, 'done']).where('id', router.matchers.number())
+    router.post('ranges/:id/release', [SeedController, 'release']).where('id', router.matchers.number())
+    router.get('status', [SeedController, 'status'])
+  })
+  .prefix('/api/v1/seed')
+  .use(middleware.seedNode())