feat(render-svc+node-agent): add job-claim endpoint and build node-agent skeleton

render-svc:
- db: ClaimJob() — atomic SELECT FOR UPDATE SKIP LOCKED; transitions job to
  Preparing, marks node Busy in a single transaction
- models: ClaimJobRequest + ClaimedJob types
- handlers/internal: POST /v1/internal/render/jobs/claim — 200 with job or 204 when queue empty
- main: register the claim route under /v1/internal (nodeAuth)

services/node-agent/ (new Go module github.com/flatrender/node-agent):
- internal/config: env-var based config (NODE_ID required, sensible defaults)
- internal/client: typed orchestrator HTTP client (Online, Heartbeat, ClaimJob,
  Complete, Fail, ReportCrash) — X-Node-Signature auth
- internal/runner: AE render via aerender.exe or mock (for dev without AE)
- cmd/agent/main: register online → heartbeat loop (5s) + poll loop (3s) →
  claim job → run render → report complete/fail; health endpoint on :7777
- Dockerfile: cross-compiles to Windows amd64 static binary

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/node-agent/internal/config/config.go

@@ -0,0 +1,89 @@
+// Package config loads node-agent runtime configuration from environment variables.
+package config
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+)
+
+// Config holds all runtime settings for the node agent.
+type Config struct {
+	// NodeID is the UUID of this render node, registered in the orchestrator.
+	// Must match a row in render.render_nodes.
+	NodeID string
+
+	// OrchestratorURL is the base URL of the V2 API gateway (internal network).
+	// Example: http://gateway:8080  or  http://172.30.0.5:8088
+	OrchestratorURL string
+
+	// NodeHMACSecret is the shared secret sent as X-Node-Signature header.
+	// Must match NODE_HMAC_SECRET in the render-svc environment.
+	NodeHMACSecret string
+
+	// Region is the datacenter/region label for this node (e.g. "iran-tehran-1").
+	// The orchestrator uses it to route region-preferred jobs to this node.
+	Region string
+
+	// AEPath is the full path to the aerender.exe binary.
+	// Example: C:\Program Files\Adobe\Adobe After Effects 2024\Support Files\aerender.exe
+	// Leave empty to use mock rendering (for development / testing without AE).
+	AEPath string
+
+	// WorkDir is the scratch directory for render temp files and AE project copies.
+	WorkDir string
+
+	// HeartbeatIntervalSec is how often the agent sends a heartbeat to the orchestrator.
+	HeartbeatIntervalSec int
+
+	// PollIntervalSec is how long the agent waits between job-claim attempts when idle.
+	PollIntervalSec int
+
+	// AgentVersion is the semantic version string reported to the orchestrator.
+	AgentVersion string
+
+	// AEVersion is the After Effects version string reported to the orchestrator.
+	// Example: "2024"
+	AEVersion string
+
+	// ListenPort is the port for the agent's own HTTP health endpoint.
+	ListenPort int
+}
+
+// Load reads configuration from environment variables, returning an error
+// if any required variable is missing.
+func Load() (*Config, error) {
+	c := &Config{
+		NodeID:               os.Getenv("NODE_ID"),
+		OrchestratorURL:      getEnv("ORCHESTRATOR_URL", "http://localhost:8088"),
+		NodeHMACSecret:       getEnv("NODE_HMAC_SECRET", "node-secret-change-me"),
+		Region:               getEnv("NODE_REGION", ""),
+		AEPath:               getEnv("AE_PATH", ""),
+		WorkDir:              getEnv("WORK_DIR", os.TempDir()),
+		AgentVersion:         getEnv("AGENT_VERSION", "0.1.0"),
+		AEVersion:            getEnv("AE_VERSION", "2024"),
+		HeartbeatIntervalSec: getInt("HEARTBEAT_INTERVAL_SEC", 5),
+		PollIntervalSec:      getInt("POLL_INTERVAL_SEC", 3),
+		ListenPort:           getInt("LISTEN_PORT", 7777),
+	}
+	if c.NodeID == "" {
+		return nil, fmt.Errorf("NODE_ID environment variable is required")
+	}
+	return c, nil
+}
+
+func getEnv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}
+
+func getInt(key string, fallback int) int {
+	if v := os.Getenv(key); v != "" {
+		if n, err := strconv.Atoi(v); err == nil {
+			return n
+		}
+	}
+	return fallback
+}