Add readiness pre-drain before graceful shutdown

The production-readiness PR set still leaves rolling deploys with an ownership gap across readiness and shutdown behavior.\n\nCurrent split:\n- #187 adds /readiness, but does not flip readiness false during shutdown.\n- #188 closes the HTTP listener on SIGTERM and drains in-flight work, but traffic can still be routed until endpoints are removed.\n- #196 adds a Kubernetes preStop sleep in the reference manifest, but the app itself has no pre-drain readiness state and non-Kubernetes deployments have no equivalent default.\n\nDesired behavior:\n- On shutdown intent, mark readiness false before closing the listener.\n- Keep accepting/draining already-routed in-flight requests during a short pre-drain window.\n- Document the required preStop / terminationGracePeriodSeconds relationship for Kubernetes and the equivalent behavior for other supervisors.\n- Add regression coverage for readiness returning 503 after shutdown starts while liveness remains process-only.\n\nThis should prevent ordinary rolling deploys from resetting in-flight requests and make the behavior owned by the app, not only by the reference manifests.

Start by tracing the existing /readiness endpoint from #187 and the SIGTERM listener and drain path from #188, then inspect the reference Kubernetes manifest from #196. Define the shutdown ordering and pre-drain timing, add regression coverage for readiness returning 503 while liveness remains process-only, and document the Kubernetes and non-Kubernetes supervisor behavior when those checks pass.