node: add bounded graceful-shutdown drain phase

Add an operator-visible Draining phase on daemon shutdown. On the
shutdown signal the node broadcasts Disconnect to all peers, then keeps
serving for a bounded window - up to node.drain_timeout_secs (default 2s),
exiting early once all peers are gone - before tearing down. This lets
in-flight traffic settle and peers observe the disconnect before the
transports close, rather than the previous immediate teardown.

The lifecycle FSM gains a Draining state plus Drain/DrainDeadlineElapsed
events; the run loop observes the shutdown signal and transitions to
draining in place - one continuous loop, so the channel receivers are
never destructively cancelled. The published NodeState gains a Draining
variant, visible via control queries during the window. The immediate
stop() path used by tests and non-daemon callers is unchanged: it still
tears down immediately with no drain wait.

The reconciler-gate actions the drain emits are no-ops until the peering
reconciler lands and consumes them.

src/node/mod.rs

@@ -168,6 +168,12 @@ pub enum NodeState {
     Starting,
     /// Fully operational.
     Running,
+    /// Bounded graceful drain in progress (design doc §6): a shutdown
+    /// `Disconnect` has been broadcast and the node is waiting for peers to
+    /// clear (bounded by `node.drain_timeout_secs`) before teardown. Not
+    /// operational; the daemon drain path advances to `Stopping` via the
+    /// supervisor's `DrainDeadlineElapsed`, never through `stop()`.
+    Draining,
     /// Shutting down.
     Stopping,
     /// Stopped.
@@ -197,6 +203,7 @@ impl fmt::Display for NodeState {
             NodeState::Created => "created",
             NodeState::Starting => "starting",
             NodeState::Running => "running",
+            NodeState::Draining => "draining",
             NodeState::Stopping => "stopping",
             NodeState::Stopped => "stopped",
         };