fix(server): invoke plugin shutdown hooks and close connections during graceful shutdown

[MarioCadenas]

Problem (reliability finding R-4, High)

Graceful shutdown was broken in three independent ways:

1. Plugin shutdown() was dead code. Six plugins (analytics, genie, files, agents, serving, vector-search) implement shutdown(), but nothing in src ever called it — _gracefulShutdown() only invoked abortActiveOperations(). Most notably, the files plugin's 10-second in-flight-write drain never ran, so writes could be killed mid-flight on every deploy. The "shutdown" lifecycle event declared in PluginContext was likewise never emitted, and BasePlugin didn't even declare the method.
2. Every shutdown with a connected browser burned the full 15s timeout and exited 1. server.close(cb) never completes while keep-alive/SSE sockets exist, so the close callback (the only exit(0) path) never fired and the force-shutdown timer called process.exit(1) — orchestrators record a crash on routine deploys.
3. Races and re-entrancy. Signal handlers used process.on (not once), allowing re-entrant shutdown, and TelemetryManager had its own competing SIGTERM flush that raced the server's process.exit.

Changes

• packages/shared/src/plugin.ts — declare shutdown?(): Promise<void> | void on BasePlugin so the contract is typed.
• packages/appkit/src/plugins/server/index.ts — rework _gracefulShutdown():
  • After aborting active operations, run every plugin's shutdown() concurrently, each bounded by a 10s per-plugin timeout (sized to cover the files plugin's 10s write drain; errors and timeouts are logged, never thrown).
  • Emit the "shutdown" lifecycle event via PluginContext.emitLifecycle().
  • Call server.closeIdleConnections() right after server.close(), and server.closeAllConnections() once plugin hooks finish, so close() can actually complete (both exist on Node ≥18.2 http.Server).
  • Switch signal handlers to process.once and add an isShuttingDown guard.
  • The 15s force-exit now exits 0 (it's a deliberate shutdown, not a crash); exit 1 is reserved for unexpected errors thrown during shutdown.
• packages/appkit/src/telemetry/telemetry-manager.ts — make TelemetryManager.shutdown() public and idempotent (SDK reference cleared synchronously; repeated/concurrent calls share one flush). The server now awaits the telemetry flush inside the orchestrated shutdown instead of racing the competing SIGTERM handler against process.exit. The existing process.once handler remains as a fallback for apps without the server plugin and is now a safe no-op when the server flushes first.
• packages/appkit/src/core/plugin-context.ts — doc update: emitLifecycle is called by core (setup:complete) and the server plugin (shutdown).

The overall 15s budget is unchanged and no new config knobs were added.

Tests

Extended packages/appkit/src/plugins/server/tests/server.test.ts (_gracefulShutdown block, following the existing mocked process.exit pattern):

• plugin shutdown() hooks are called during graceful shutdown (and skipped for plugins without one)
• a failing hook is logged and doesn't abort shutdown
• a hanging hook doesn't block past its 10s timeout (fake timers)
• the "shutdown" lifecycle event fires
• closeIdleConnections()/closeAllConnections() are called so close() completes
• shutdown is not re-entrant (second signal is a no-op)
• exits 0 with and without a server instance

Verification

• pnpm install ✓
• pnpm build ✓
• pnpm -r typecheck ✓
• pnpm check:fix ✓ (no diagnostics on changed files)
• Full appkit suite: 119 files, 2146 tests passed (includes server, telemetry, plugin-context, files/serving/vector-search shutdown tests)

This pull request and its description were written by Isaac.