feat(render-svc+node-agent): add job-claim endpoint and build node-agent skeleton

render-svc:
- db: ClaimJob() — atomic SELECT FOR UPDATE SKIP LOCKED; transitions job to
  Preparing, marks node Busy in a single transaction
- models: ClaimJobRequest + ClaimedJob types
- handlers/internal: POST /v1/internal/render/jobs/claim — 200 with job or 204 when queue empty
- main: register the claim route under /v1/internal (nodeAuth)

services/node-agent/ (new Go module github.com/flatrender/node-agent):
- internal/config: env-var based config (NODE_ID required, sensible defaults)
- internal/client: typed orchestrator HTTP client (Online, Heartbeat, ClaimJob,
  Complete, Fail, ReportCrash) — X-Node-Signature auth
- internal/runner: AE render via aerender.exe or mock (for dev without AE)
- cmd/agent/main: register online → heartbeat loop (5s) + poll loop (3s) →
  claim job → run render → report complete/fail; health endpoint on :7777
- Dockerfile: cross-compiles to Windows amd64 static binary

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/render/internal/models/models.go

@@ -402,6 +402,21 @@ type CrashReportRequest struct {
 	LogFileURL     *string    `json:"log_file_url"`
 }
 
+type ClaimJobRequest struct {
+	NodeID  uuid.UUID `json:"node_id"  binding:"required"`
+	Region  string    `json:"region"`
+}
+
+type ClaimedJob struct {
+	JobID          uuid.UUID `json:"job_id"`
+	SavedProjectID uuid.UUID `json:"saved_project_id"`
+	Quality        string    `json:"quality"`
+	Resolution     string    `json:"resolution"`
+	FrameRate      int       `json:"frame_rate"`
+	HasMusic       bool      `json:"has_music"`
+	HasVoiceover   bool      `json:"has_voiceover"`
+}
+
 type CacheUpdateRequest struct {
 	Action        string     `json:"action"         binding:"required"`
 	ProjectID     *uuid.UUID `json:"project_id"`