Spotnet import, header backfill, staging and counter grouping, faster search

Spotnet (CONCEPT D29):
- Index free.pt fully and import spots with their descriptions, categories
  and NZBs; a spot renames its release, since Spotnet names are more
  trustworthy than names derived from subjects.
- Find passwords in spot descriptions too, and tell "needs a password we
  have" from "needs a password we don't have".

Content inspection:
- List the contents of 7z (.7z.001) archives, SFV sets, nicovideo uploads
  and other archive-like files; mark yEncBin .bin containers as encrypted.
- Take real names from yEnc headers for randomly named files, and merge
  uploads that were split across posts.

Storage (D31, D32):
- Store segment lists zstd-compressed behind the FileStore accessor.
- group:backfill indexes older headers at low priority and pauses when
  the NVMe or HDD part of the database gets too large.

Grouping (D35, D36):
- Lone header segments wait in staged_segments until a second segment of
  their file arrives, which drops the per-article junk binaries.
- Counter grouping joins random-subject uploads by poster, [i/M] counter,
  part count and day.

Search and maintenance (D33, D34):
- A trigram-indexed search_text column, smaller indexes, estimated stats.
- Passes that clean up nonsense names; weekly index maintenance; GC budgets
  per kind.
- Web UI: grey out stale results while a search runs and cancel superseded
  requests. Count only up to 1,000 matches for the page, which made filter
  clicks take seconds (Newznab keeps the 10,000 cap).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/content/sniff.ts

@@ -2,6 +2,8 @@
  * Recognises a file type from its first bytes, independent of AdonisJS.
  * `nzbe` is an encrypted-NZB container seen on Usenet (LOG.md 2026-09-28 (11)):
  * "nzbe", 16 random bytes (salt/IV), then ciphertext.
+ * `yencbin` is the encrypted `.bin` container of `yEncBin@Poster.com`
+ * (LOG.md 2026-09-30 (3)): a fixed header, then data with 8 bits/byte of entropy.
  */
 export type ContentType =
   | 'nzbe'
@@ -16,6 +18,7 @@ export type ContentType =
   | 'matroska'
   | 'mp4'
   | 'rclone'
+  | 'yencbin'
   | 'iso'
   | 'udf'
   | 'pdf'
@@ -29,7 +32,11 @@ export type ContentType =
   | 'ogg'
   | 'bzip2'
 
-const SIGNATURES: [ContentType, number, number[]][] = [
+/** Magic bytes at an offset; null matches any byte. */
+const SIGNATURES: [ContentType, number, (number | null)[]][] = [
+  // Two header variants seen (54f399d117c49269 6e4dc4ef5b60c11d…, 54f399e917c49269 6a4e9fb05b60c31d…):
+  // the bytes they share.
+  ['yencbin', 0, [0x54, 0xf3, 0x99, null, 0x17, 0xc4, 0x92, 0x69, null, null, null, null, 0x5b, 0x60, null, 0x1d, 0x7f, 0x83, 0xe9, 0x2d]],
   ['nzbe', 0, [0x6e, 0x7a, 0x62, 0x65]],
   ['par2', 0, [0x50, 0x41, 0x52, 0x32, 0x00, 0x50, 0x4b, 0x54]],
   ['rar5', 0, [0x52, 0x61, 0x72, 0x21, 0x1a, 0x07, 0x01, 0x00]],
@@ -53,7 +60,7 @@ const SIGNATURES: [ContentType, number, number[]][] = [
 
 export function sniffContentType(data: Buffer): ContentType | null {
   for (const [type, offset, bytes] of SIGNATURES) {
-    if (data.length >= offset + bytes.length && bytes.every((b, i) => data[offset + i] === b)) return type
+    if (data.length >= offset + bytes.length && bytes.every((b, i) => b === null || data[offset + i] === b)) return type
   }
   // Disc images, visible when the first part is big enough (sector 16 at 32 KiB):
   // ISO 9660 has "CD001"; UDF (DVD/Blu-ray) has BEA01 followed by NSR02/NSR03.