Handle SIGTERM/SIGINT for a graceful shutdown

Running as PID 1 in a container, the daemon silently dropped SIGTERM,
so `docker stop` always hit the 10s timeout and SIGKILL, and host
reboots waited on it.

The accept loop now polls a non-blocking listener and a shutdown flag
registered via signal-hook. On SIGTERM or SIGINT it stops accepting,
gives in-flight requests up to 3s to finish, removes the socket file,
and exits with status 0. Log lines mark signal receipt and completion.

Adds integration tests that spawn the binary, perform an auth
round-trip, signal it, and assert a clean exit and socket removal.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kmrgkpp9YBJ6AMaWYPPZuD

Cargo.lock

@@ -208,6 +208,16 @@ dependencies = [
  "log",
 ]
 
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
 [[package]]
 name = "generic-array"
 version = "0.14.7"
@@ -386,6 +396,27 @@ dependencies = [
  "common",
  "env_logger",
  "log",
+ "signal-hook",
+]
+
+[[package]]
+name = "signal-hook"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a0c28ca5908dbdbcd52e6fdaa00358ab88637f8ab33e1f188dd510eb44b53d"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
 ]
 
 [[package]]