shut down gracefully on SIGINT/SIGTERM and wipe temp secrets

[fabracht]

Closes #32.

Summary

• mqdb agent start and mqdb cluster start now install signal handlers (Ctrl-C on all platforms, SIGTERM on unix); on signal they trigger the agent's existing shutdown channel, await graceful task drain, then remove the process-scoped inline-secret temp directory (${TMPDIR}/mqdb-env-secrets-{pid}/). Previously the default handler killed the process immediately, skipping graceful shutdown and leaving 0o600 secret files on disk until reboot.
• the agent's run/start now race broker.run() against the shutdown channel, so MqdbAgent::shutdown() actually stops the broker instead of only signalling the auxiliary tasks (the pre-existing gap that made a CLI-only signal handler insufficient)
• ClusteredAgent gains shutdown_handle() so a signal task can trigger shutdown while run(&mut self) holds the borrow (the cluster event loop already selects on the shutdown channel)
• env_secret::cleanup() removes the temp secret directory, best-effort

Test plan

• agent_run_task_stops_on_shutdown — run task returns on shutdown instead of blocking on the broker (times out under the old code)
• cleanup_removes_process_secret_dir — temp secret dir written then removed by cleanup
• real SIGTERM smoke: agent started with inline MQDB_PASSWD (creates the 0600 secret dir), kill -TERM → process exits gracefully, secret dir removed, port released
• clippy clean on all targets; agent/cluster/cli suites green (pre-existing test_cli_connect_timeout_against_silent_listener timing flake excepted)