feat(render-svc+node-agent): add job-claim endpoint and build node-agent skeleton

render-svc:
- db: ClaimJob() — atomic SELECT FOR UPDATE SKIP LOCKED; transitions job to
  Preparing, marks node Busy in a single transaction
- models: ClaimJobRequest + ClaimedJob types
- handlers/internal: POST /v1/internal/render/jobs/claim — 200 with job or 204 when queue empty
- main: register the claim route under /v1/internal (nodeAuth)

services/node-agent/ (new Go module github.com/flatrender/node-agent):
- internal/config: env-var based config (NODE_ID required, sensible defaults)
- internal/client: typed orchestrator HTTP client (Online, Heartbeat, ClaimJob,
  Complete, Fail, ReportCrash) — X-Node-Signature auth
- internal/runner: AE render via aerender.exe or mock (for dev without AE)
- cmd/agent/main: register online → heartbeat loop (5s) + poll loop (3s) →
  claim job → run render → report complete/fail; health endpoint on :7777
- Dockerfile: cross-compiles to Windows amd64 static binary

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/render/internal/handlers/internal.go

@@ -198,6 +198,37 @@ func (h *InternalHandler) ReplicaReady(c *gin.Context) {
 	c.Status(http.StatusNoContent)
 }
 
+// POST /v1/internal/render/jobs/claim
+// Node agent calls this to atomically claim the next queued job.
+// Returns 204 when there is nothing queued (agent should back off and retry).
+func (h *InternalHandler) Claim(c *gin.Context) {
+	var req models.ClaimJobRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, models.APIError{Code: "bad_request", Message: err.Error()})
+		return
+	}
+
+	job, err := h.store.ClaimJob(c.Request.Context(), req.NodeID, req.Region)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, models.APIError{Code: "internal_error", Message: err.Error()})
+		return
+	}
+	if job == nil {
+		c.Status(http.StatusNoContent) // nothing queued
+		return
+	}
+
+	c.JSON(http.StatusOK, models.ClaimedJob{
+		JobID:          job.ID,
+		SavedProjectID: job.SavedProjectID,
+		Quality:        job.Quality,
+		Resolution:     job.Resolution,
+		FrameRate:      job.FrameRate,
+		HasMusic:       job.HasMusic,
+		HasVoiceover:   job.HasVoiceover,
+	})
+}
+
 // POST /v1/internal/nodes/:node_id/cache-update
 func (h *InternalHandler) CacheUpdate(c *gin.Context) {
 	nodeID, err := uuid.Parse(c.Param("node_id"))