feat(render-svc+node-agent): add job-claim endpoint and build node-agent skeleton

render-svc:
- db: ClaimJob() — atomic SELECT FOR UPDATE SKIP LOCKED; transitions job to
  Preparing, marks node Busy in a single transaction
- models: ClaimJobRequest + ClaimedJob types
- handlers/internal: POST /v1/internal/render/jobs/claim — 200 with job or 204 when queue empty
- main: register the claim route under /v1/internal (nodeAuth)

services/node-agent/ (new Go module github.com/flatrender/node-agent):
- internal/config: env-var based config (NODE_ID required, sensible defaults)
- internal/client: typed orchestrator HTTP client (Online, Heartbeat, ClaimJob,
  Complete, Fail, ReportCrash) — X-Node-Signature auth
- internal/runner: AE render via aerender.exe or mock (for dev without AE)
- cmd/agent/main: register online → heartbeat loop (5s) + poll loop (3s) →
  claim job → run render → report complete/fail; health endpoint on :7777
- Dockerfile: cross-compiles to Windows amd64 static binary

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/node-agent/internal/runner/runner.go

@@ -0,0 +1,141 @@
+// Package runner executes After Effects render jobs and streams progress back
+// via the provided callback. When AE_PATH is empty, a mock render is used
+// (useful for CI and dev environments without a licensed AE installation).
+package runner
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"time"
+)
+
+// ProgressFn is called periodically during rendering with (percent 0-100, message).
+type ProgressFn func(ctx context.Context, percent int, message string) error
+
+// Job holds the parameters for a single render.
+type Job struct {
+	JobID          string
+	SavedProjectID string
+	Quality        string
+	Resolution     string
+	FrameRate      int
+	HasMusic       bool
+	HasVoiceover   bool
+	// AEPFilePath is the local path to the downloaded .aep project file.
+	// In a full implementation the agent downloads this from MinIO before calling Run.
+	AEPFilePath string
+}
+
+// Run executes the render job, calling onProgress as it advances.
+// Returns the path to the output MP4 file on success.
+func Run(ctx context.Context, aePath, workDir string, job *Job, onProgress ProgressFn) (string, error) {
+	outputDir := filepath.Join(workDir, "renders", job.JobID)
+	if err := os.MkdirAll(outputDir, 0o755); err != nil {
+		return "", fmt.Errorf("create output dir: %w", err)
+	}
+	outputPath := filepath.Join(outputDir, "output.mp4")
+
+	if aePath == "" {
+		return mockRender(ctx, job, outputPath, onProgress)
+	}
+	return aeRender(ctx, aePath, job, outputPath, onProgress)
+}
+
+// ── Mock render (no AE installed) ────────────────────────────────────────────
+
+func mockRender(ctx context.Context, job *Job, outputPath string, onProgress ProgressFn) (string, error) {
+	log.Printf("[mock] starting render for job %s (%s %s %dfps)", job.JobID, job.Quality, job.Resolution, job.FrameRate)
+
+	steps := []struct {
+		pct int
+		msg string
+	}{
+		{5, "Preparing project…"},
+		{15, "Loading template…"},
+		{30, "Rendering frames…"},
+		{50, "Rendering frames… (50%)"},
+		{70, "Rendering frames… (70%)"},
+		{85, "Encoding MP4…"},
+		{95, "Uploading output…"},
+	}
+
+	for _, s := range steps {
+		select {
+		case <-ctx.Done():
+			return "", ctx.Err()
+		case <-time.After(800 * time.Millisecond):
+		}
+		if err := onProgress(ctx, s.pct, s.msg); err != nil {
+			log.Printf("[mock] progress callback error: %v", err)
+		}
+		log.Printf("[mock] %d%% — %s", s.pct, s.msg)
+	}
+
+	// Write a placeholder file so the path is valid
+	if err := os.WriteFile(outputPath, []byte("mock-render-output"), 0o644); err != nil {
+		return "", fmt.Errorf("write mock output: %w", err)
+	}
+	log.Printf("[mock] render complete: %s", outputPath)
+	return outputPath, nil
+}
+
+// ── Real AE render via aerender.exe ──────────────────────────────────────────
+
+func aeRender(ctx context.Context, aePath string, job *Job, outputPath string, onProgress ProgressFn) (string, error) {
+	if job.AEPFilePath == "" {
+		return "", fmt.Errorf("AEPFilePath is required for real AE render")
+	}
+
+	// aerender flags:
+	//   -project <path.aep>
+	//   -output  <output.mp4>
+	//   -RStemplate "Multi-Machine Settings"   (optional)
+	//   -OMtemplate "H.264 – Match Render Settings – 15 Mbps"
+	//   -s <start_frame> -e <end_frame>
+	args := []string{
+		"-project", job.AEPFilePath,
+		"-output", outputPath,
+	}
+
+	log.Printf("[ae] running: %s %v", aePath, args)
+	cmd := exec.CommandContext(ctx, aePath, args...)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+
+	if err := cmd.Start(); err != nil {
+		return "", fmt.Errorf("start aerender: %w", err)
+	}
+
+	// Poll process while alive — aerender does not expose machine-readable progress.
+	// We advance the progress indicator every 10 seconds until the process exits.
+	done := make(chan error, 1)
+	go func() { done <- cmd.Wait() }()
+
+	_ = onProgress(ctx, 10, "After Effects starting…")
+	pct := 10
+	ticker := time.NewTicker(10 * time.Second)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case err := <-done:
+			if err != nil {
+				return "", fmt.Errorf("aerender exit: %w", err)
+			}
+			_ = onProgress(ctx, 95, "Encoding complete")
+			return outputPath, nil
+		case <-ticker.C:
+			if pct < 90 {
+				pct += 5
+			}
+			_ = onProgress(ctx, pct, fmt.Sprintf("Rendering… %d%%", pct))
+		case <-ctx.Done():
+			_ = cmd.Process.Kill()
+			return "", ctx.Err()
+		}
+	}
+}