Task: Implement session cancellation

Cancel all active sessions when the server stops, so it can shut down cleanly under SIGINT or programmatic shutdown. Critical for container orchestration and service restarts.

• Server can stop cleanly with multiple active sessions running.
• All session I/O operations cancelled when server::stop() is called.
• No indefinite hangs during shutdown.
• Sessions log their cancellation for observability.

(Plan was distilled into the parent story's * Decisions and cleared when the task closed.)

• Total time spent in v0: ~2:42.
• Important pivot: original plan used Boost.Asio's hierarchical cancellation_signal model — but cancellation_signal contains exactly ONE slot that holds ONE handler at a time, so multiple sessions calling slot.assign() overwrite each other. Tests showed only 1/3 sessions cancelled; the Deepseek-suggested idiomatic example segfaulted.
• Final solution: explicit session management. Server maintains std::list<std::shared_ptr<session>> protected by a mutex; sessions added/removed on create/complete; server::stop() explicitly calls session::stop() on each active session; session::stop() closes the connection, causing pending I/O to fail.
• Gemini code review pass also caught a race in main.cpp (redundant signal handler) and an unclean connection-state path in client.cpp on read failure.

Server shuts down cleanly with multiple sessions; all 3/3 sessions properly cancelled in tests; race + clean-state issues fixed via Gemini review.