Fix records/query auth mismatch and add bounded shutdown

[cuibonobo]

Summary

Closes the two items still open in #49 (the other four were already fixed by prior work, per the issue's own follow-up comment):

• POST /records/query auth doc mismatch: the route required auth while docs/api.md listed it as Optional. Aligned code to the docs (removed requireAuth()) rather than the reverse, since GET /records is already anonymous-friendly and /records/query is documented as a superset of the same query surface. Pinned with a test mirroring the existing GET /records anonymous-query test. Updated docs/deployment.md's two mentions of anonymous-reachable read routes to include POST /records/query.
• Unbounded shutdown: shutdown() waited on server.close() with no deadline, so a client holding a keep-alive connection open could block it indefinitely. Added a configurable SHUTDOWN_TIMEOUT_MS (default 10s, same pattern as QUERY_TIMEOUT_MS), after which open connections are forced closed via closeAllConnections() so cleanup still runs. Also added stack.flush() to the fatal-startup-error path, guarded for the case where the crash happens before the stack context exists. The shutdown sequence is extracted into src/shutdown.ts so it's unit-testable without touching process.exit.

Test plan

• pnpm test — 336 tests pass, including new coverage for anonymous POST /records/query, SHUTDOWN_TIMEOUT_MS config validation, and the shutdown handler's timeout/no-timeout/no-closeAllConnections paths
• pnpm typecheck
• pnpm lint
• pnpm format:check

---

Generated by Claude Code