Analytics shutdown flush is best-effort and can be lost on process exit

Following on from #55 / #57, the analytics thread now flushes buffered counts when its last sender drops, but nothing waits for that flush to finish.

We can fix that, however, we need to make design decisions around `AnalyticsProcessor` lifecycle to find the best place to block at. Right now, `AnalyticsProcessor` clones owned by `Flags` can outlive `Flagsmith`, which is arguably wrong.

### Options

1. Add explicit `shutdown()` on `Flagsmith` that closes the channel and joins with a bounded timeout; stop giving `Flags` an owning clone so the processor's lifetime is tied to `Flagsmith` alone.
2. Leave it best-effort and document it.
3. Something else?

Start by tracing the AnalyticsProcessor lifecycle and its owning clones in Flags and Flagsmith. Compare the listed shutdown and best-effort options, including channel closure and bounded joining. Done means the lifecycle decision is explicit and analytics flush behavior on process exit is reliable or deliberately documented.

Written by the indexing model from the issue text.