Spotnet import, header backfill, staging and counter grouping, faster search

Spotnet (CONCEPT D29):
- Index free.pt fully and import spots with their descriptions, categories
  and NZBs; a spot renames its release, since Spotnet names are more
  trustworthy than names derived from subjects.
- Find passwords in spot descriptions too, and tell "needs a password we
  have" from "needs a password we don't have".

Content inspection:
- List the contents of 7z (.7z.001) archives, SFV sets, nicovideo uploads
  and other archive-like files; mark yEncBin .bin containers as encrypted.
- Take real names from yEnc headers for randomly named files, and merge
  uploads that were split across posts.

Storage (D31, D32):
- Store segment lists zstd-compressed behind the FileStore accessor.
- group:backfill indexes older headers at low priority and pauses when
  the NVMe or HDD part of the database gets too large.

Grouping (D35, D36):
- Lone header segments wait in staged_segments until a second segment of
  their file arrives, which drops the per-article junk binaries.
- Counter grouping joins random-subject uploads by poster, [i/M] counter,
  part count and day.

Search and maintenance (D33, D34):
- A trigram-indexed search_text column, smaller indexes, estimated stats.
- Passes that clean up nonsense names; weekly index maintenance; GC budgets
  per kind.
- Web UI: grey out stale results while a search runs and cancel superseded
  requests. Count only up to 1,000 matches for the page, which made filter
  clicks take seconds (Newznab keeps the 10,000 cap).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/services/NntpService.ts

@@ -1,5 +1,5 @@
 import nntpConfig from '#config/nntp'
-import { NNTP } from "nntp-js";
+import { NNTP } from "#lib/nntp/nntp_js";
 import { parseGroupResponse, type GroupInfo } from '#lib/nntp/group'
 
 class NntpService {
@@ -94,6 +94,20 @@ class NntpService {
     return parseGroupResponse(resp)
   }
 
+  /**
+   * Rejects when `promise` hasn't settled within `ms`. nntp-js has no
+   * timeouts: a connection the server stops answering (still ESTABLISHED,
+   * nothing in flight) leaves its command waiting forever. The caller must
+   * then release the connection as failed, so it's destroyed.
+   */
+  public timed<T>(promise: Promise<T>, what: string, ms = nntpConfig.commandTimeoutMs): Promise<T> {
+    let timer: NodeJS.Timeout
+    const timeout = new Promise<never>((_, reject) => {
+      timer = setTimeout(() => reject(new Error(`NNTP ${what}: no answer within ${ms / 1000} s`)), ms)
+    })
+    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer))
+  }
+
   /** Fetches a raw (still dot-stuffed) article body as a Buffer. */
   public async fetchBody(conn: any, messageId: string): Promise<Buffer> {
     const id = messageId.startsWith('<') ? messageId : `<${messageId}>`