Slurm's ports for the cluster only, and srun in a range of its own

slurm.conf sets SrunPortRange=60001-63000, so a site's firewall can let
srun's step connections in. A node given a part in Slurm adds 6817-6818
and that range to llmgw's nftables table, open to the cluster's networks
and closed to everyone else, as the engines' ports are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -41,6 +41,15 @@ APIs change between minors without a deprecation period.
   organization's name and the rest of the cluster stay with the cluster's
   administrators; an admin cannot take away their own role. Every change is in
   the audit log.
+- **Slurm beside llmgw, for training and batch work.** `llmgw ctl slurm setup
+  --controller NODE --nodes NODE,...` (or `--all-nodes`, or `server init
+  --slurm`) has the agents install munge and Slurm from the machines' package
+  sources: slurmctld on one node, slurmd configless on the others, slurm.conf
+  and gres.conf written from what each node reports. Every node stays llmgw's,
+  drained in Slurm, until `ctl slurm lend NODE`: its replicas move off, then
+  Slurm runs jobs there. `ctl slurm reclaim NODE` takes it back once its jobs
+  end. `ctl slurm status` shows each node. Slurm's ports (6817–6818, srun's
+  60001–63000) answer the cluster's networks only, as llmgw's own do.
 
 ### Changed