feat(render-svc+node-agent): add job-claim endpoint and build node-agent skeleton

render-svc:
- db: ClaimJob() — atomic SELECT FOR UPDATE SKIP LOCKED; transitions job to
  Preparing, marks node Busy in a single transaction
- models: ClaimJobRequest + ClaimedJob types
- handlers/internal: POST /v1/internal/render/jobs/claim — 200 with job or 204 when queue empty
- main: register the claim route under /v1/internal (nodeAuth)

services/node-agent/ (new Go module github.com/flatrender/node-agent):
- internal/config: env-var based config (NODE_ID required, sensible defaults)
- internal/client: typed orchestrator HTTP client (Online, Heartbeat, ClaimJob,
  Complete, Fail, ReportCrash) — X-Node-Signature auth
- internal/runner: AE render via aerender.exe or mock (for dev without AE)
- cmd/agent/main: register online → heartbeat loop (5s) + poll loop (3s) →
  claim job → run render → report complete/fail; health endpoint on :7777
- Dockerfile: cross-compiles to Windows amd64 static binary

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/node-agent/Dockerfile

@@ -0,0 +1,19 @@
+# Build stage — cross-compile for Windows amd64
+FROM golang:1.25-alpine AS builder
+
+WORKDIR /src
+COPY go.mod ./
+# No external dependencies yet — no go.sum needed
+COPY . .
+
+# Produce a static Windows binary
+RUN GOOS=windows GOARCH=amd64 CGO_ENABLED=0 \
+    go build -mod=mod -trimpath -ldflags="-s -w" \
+    -o /out/flatrender-node-agent.exe \
+    ./cmd/agent
+
+# ── Output stage ───────────────────────────────────────────────────────────────
+# For dev/CI use only — the production binary is copied to Windows render nodes.
+FROM scratch
+COPY --from=builder /out/flatrender-node-agent.exe /flatrender-node-agent.exe
+ENTRYPOINT ["/flatrender-node-agent.exe"]