feat(server): graceful shutdown - #120

Adds `Server::graceful_shutdown` that actually drains the server before
exiting, replacing the loop-break-only behavior proposed in #120.

Semantics:
- New connections delivered after shutdown begins are rejected with a
  Close(Away) frame instead of being left to hang on an undrained queue.
- Queued `Server::call` messages are dropped (no `on_call` after shutdown).
- Every live session is sent a Close(Away, "server shutting down") frame
  via a per-session watch::Receiver task; the actor then awaits the
  natural close path so `on_disconnect` fires for every session.
- The future resolves only after all sessions have drained, and the
  server-actor task returned by `Server::create` exits at the same time.
- Concurrent callers are all acknowledged; calls after the actor has
  exited return `GracefulShutdownError::ServerStopped`.

Tests cover: full drain of live sessions with CloseCode::Away delivered
to `on_disconnect`, immediate completion when no sessions exist, and
idempotency across concurrent callers plus the post-exit error case.

The `examples/echo-server-graceful-shutdown` example shows the intended
shutdown sequence: abort the TCP acceptor, await `graceful_shutdown`,
await the server task.

Supersedes #120.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>