feat: gracefully drain seller requests on shutdown

[alexanderludwig]

Summary

Implements the graceful-shutdown portion of #981. Refs #981; this PR intentionally does not close the issue because hot pricing reload is covered by a separate draft.

• Stop advertising and reject new requests with HTTP 503 and new reserve operations once shutdown begins.
• Let active requests finish, accept final spending authorizations, and drain outgoing transport buffers before closing connections.
• Add a default 60-second drain budget, configurable through --shutdown-drain-timeout-ms or SDK shutdownDrainTimeoutMs; coalesce concurrent stop() calls.
• Suppress late response frames and billing after the drain deadline. Document shutdown behavior in the CLI README and changelog.

PR split / merge order

This is the standalone first PR, targeting main. The pricing-reload draft #985 on feat/seller-price-hot-reload targets this branch so each review contains only its own feature. Merge this PR first, then retarget #985 to main.

Validation

• Protocol, buyer-core, node, and CLI builds.
• CLI typecheck and git diff --check.
• Full node suite: 1,026 tests across 93 files.
• CLI config and seller-command suite: 82 tests.
• Regression coverage for active streams, HTTP 503 during drain, timeouts, late-frame/billing suppression, final spending authorization, shutdown ordering, concurrent stop calls, and outgoing buffers.

Limits

The timeout bounds request/payment/transport draining, not subsequent on-chain settlement and cleanup. Forced termination (SIGKILL) cannot drain. No live-chain deployment testing was performed.