fix(server): shut down through fx so buffered reports flush (closes #22)

The server ran os.Exit at the end of its own goroutine, racing fx's
teardown and sometimes killing the process before reportbuf's OnStop
flushed — silently losing a full flush window of telemetry on every
restart, at exit 0. Shutdown now goes through fx.Shutdowner, so every
OnStop runs in order.

The http.Server is built synchronously in OnStart before the serving
goroutine, so shutdown can no longer race or nil-deref it. A listen
failure exits non-zero via fx.ExitCode(1). reportbuf's OnStop is guarded
by sync.Once. writeTimeout now exceeds the chi per-request budget so that
budget is reachable. Dead startupTime, exitCode, and cancelFunc fields
are gone. A new test asserts a buffered report reaches disk after the
lifecycle stops.

Model: opus-4-8

backend/internal/reportbuf/reportbuf.go

@@ -40,11 +40,12 @@ type Params struct {
 // Buffer accumulates JSON lines in memory and flushes them
 // to zstd-compressed files on disk.
 type Buffer struct {
-	buf     bytes.Buffer
-	dataDir string
-	done    chan struct{}
-	log     *slog.Logger
-	mu      sync.Mutex
+	buf      bytes.Buffer
+	dataDir  string
+	done     chan struct{}
+	log      *slog.Logger
+	mu       sync.Mutex
+	stopOnce sync.Once
 }
 
 // New creates a Buffer and registers lifecycle hooks to
@@ -76,8 +77,13 @@ func New(
 			return nil
 		},
 		OnStop: func(_ context.Context) error {
-			close(b.done)
-			b.flushLocked()
+			// stopOnce makes OnStop idempotent: a second
+			// invocation must not close an already-closed channel
+			// (which would panic) or flush again.
+			b.stopOnce.Do(func() {
+				close(b.done)
+				b.flushLocked()
+			})
 
 			return nil
 		},