Resume node downloads and lengthen the enrollment token

[SaladDay]

What

• Node artifact downloads resume with an HTTP Range request. An interrupted or failed download keeps its .partial file; the next attempt or rerun continues from its size, prints Resuming <file> at X MiB of Y MiB, and falls back to a full download when the server answers 200 or 416, or when the resumed bytes fail the checksum. Redirects (Core to GitHub) forward only the Range header.
• Every artifact prints 10% progress lines (was only files of 50 MiB or more).
• The disk preflight counts bytes already in a partial file as present.
• The enrollment token lives 1 hour (runtime_node_enrollments insert in runtime_nodes.sql and the generated sqlc file). Web already reads expires_at from Core's response, so the countdown follows; e2e fixtures and docs updated.
• Docs: docs/getting-started/nodes.md (EN + zh, source_hash refreshed), deploy/node/README.md.

Why

Audit-node finding 2 and P2 9: slow links restarted at byte 0 and outlived the 10-minute token. Verified: Core's local artifact serving uses http.ServeContent (Range supported); GitHub release assets answer 206 with Content-Range after the 302 (checked with curl).

Verification

• python3 -m unittest discover in deploy/node: 148 tests OK (1 skipped). New cases: resume from an earlier partial, resume after a mid-transfer break, server ignoring Range (200, full download), oversize partial dropped, unrelated partial restarted after checksum failure, Range through an HTTPS redirect.
• go build ./..., go vet ./..., go test ./internal/deployment/... in services/core: OK.
• pnpm --filter @oac/web typecheck, vitest node-enrollment.test.ts: OK. scripts/check-names.py: OK.
• Translation guard tests 1-2 pass.

Skipped

• Translation guard test 3 (needs vitepress), Playwright nodes.spec.ts (no browser here; only its 10-minute timings changed to 1 hour), DB-backed Go integration tests, root installer run.
• Live check on mx2: throttled/interrupted Docker and microsandbox install, rerun prints Resuming, expiry after >1 h of token age re-registers with a new command and the same partial files.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}