Give the runtime real readiness, graceful shutdown and stated limits

Closes gap G08. /healthz returned a constant without probing anything, the server
called ListenAndServe with no signal handling, and the operational limits of
in-memory state, startup-loaded keys and local-only logout lived in code comments
rather than anywhere an operator would look.

/readyz probes LLDAP, Authelia and privacyIDEA; /healthz stays liveness and
probes nothing. Keeping them distinct matters: wiring liveness to dependency
health means an orchestrator restarts KeyCape when a dependency blinks, and a
restart also discards every in-flight login, so the reaction is worse than the
condition it reacts to.

LLDAP is probed with a bind rather than a dial, since a rotated or revoked
service password leaves the port open and every lookup failing -- exactly what
readiness should catch and exactly what a dial would miss. The response names the
failing check but never the reason: the endpoint is unauthenticated and upstream
error text carries hostnames and sometimes credentials-in-URLs. Results are
cached for 2s so an unauthenticated endpoint cannot be used to drive unbounded
upstream traffic, and probes run concurrently under a 3s bound so a hung
dependency makes the endpoint answer rather than hang with it.

SIGTERM and SIGINT now drain in-flight requests for 15s, under the 30s read/write
timeouts so a stuck request cannot outlive the window before SIGKILL.

docs/operations.md states the single-replica topology and why, and three limits
easy to get wrong: the constant key-1 key ID makes same-kid rotation a trap for
consumers caching JWKS, removing a client does not revoke its issued tokens, and
/logout is local only. No throughput figures are given, since nothing here
benchmarks KeyCape. Shared storage and refresh tokens stay excluded, as G08
allows.

Verified in the running executable: 503 naming all three checks failed while
/healthz returned 200, the LLDAP check flipping to ok once started, and 40/40
requests succeeding across a SIGTERM.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

history/2026-09-05-011726-scope-intent-assessment.md

@@ -387,6 +387,23 @@ restart behavior, and coordinate key/client lifecycle and consumer refresh.
 Shared storage or refresh tokens need not be added if the accepted profile
 explicitly excludes them. Benchmark before asserting resource-efficiency bounds.
 
+**Status 2026-09-08 (KEY-WP-0025): closed.** `/readyz` probes LLDAP (by bind, so
+a revoked service password is caught), Authelia and privacyIDEA, with results
+cached 2s and each probe bounded at 3s; `/healthz` stays liveness and probes
+nothing, so a dependency blip cannot trigger a restart that also discards every
+in-flight login. Failures name the check but not the reason, since the endpoint is
+unauthenticated. `SIGTERM`/`SIGINT` drain in-flight requests for 15s. Verified in
+the running executable: 503 with all three failed while `/healthz` returned 200,
+the LLDAP check flipping to ok once started, and 40/40 requests succeeding across
+a SIGTERM.
+
+`docs/operations.md` states the single-replica topology and why, restart
+behaviour, and three limits easy to get wrong: the constant `key-1` key ID makes
+same-kid rotation a trap for consumers caching JWKS; removing a client does not
+revoke its issued tokens; `/logout` is local only. No throughput or resource
+figures are asserted, since nothing benchmarks KeyCape. Shared storage and
+refresh tokens remain deliberately excluded.
+
 ### G09 — Packaging/bootstrap and older CLI credential handling need reconciliation
 
 **Priority: medium. Kind: operational/tooling gap.**