feat(endpoint): urus is a supervisable child — endpoint gen_server owns listeners + conns

The v0.3 shape from the spec: an app owns its runtime and root supervisor
and places urus in it as one ordered child among its own.

  your root sup
  └── ChildSpec(Permanent, urus::endpoint(cfg, pipeline)?)  <- Endpoint
      └── listener_sup  OneForOne over N listeners
          └── plain connection actors

- src/conn_registry.rs -> src/endpoint.rs. The registry gains the listener
  pool it registers for and becomes the Endpoint gen_server; ConnRegistry
  -> Endpoint. It runs inline as the ChildSpec's actor
  (NamedGenServerBuilder::run), so supervisor shutdown arrives as
  handle_shutdown and a restart re-runs init on the same still-open fds.
- Endpoint spawns its OWN listener sup in init rather than being its
  sibling: smarm's supervisor start order is not start *readiness* (spawn
  is fire-and-forget), so a sibling listener could whereis the name before
  the registry actor ran. Registrar-spawns-consumers makes it program
  order inside one init. Gap filed in smarm ROADMAP (readiness ack);
  making spawn blocking would only shrink the window, not close it —
  'has begun executing' is not 'has bound its name'.
- Listener sup is monitored: death outside shutdown = panic (loud, the
  app's supervisor decides) instead of a zombie on a dead port. Death
  during shutdown is the 'no new connections' barrier.
- DELETED: the shutdown AtomicBool, LISTENER_TICK (250ms wake per listener
  per tick, now an untimed wait_readable park), SHUTDOWN_POLL (100ms root
  poll — the root parks on the signal channel now), Restart::Transient
  (listeners are Permanent: they only exit by supervisor action, so a
  self-exit always means breakage). Verified against current smarm:
  request_stop unwinds an untimed wait_readable park, is no longer lossy
  against a QUEUED actor, and supervisor shutdown joins in ~200us.
- Config: scheduler_threads/max_actors removed (runtime knobs an
  endpoint-as-child cannot honour) -> serve_with(cfg, smarm::Config, pipe)
  and serve_with_shutdown(cfg, smarm::Config, pipe, signal). Added
  Config.name (default 'urus'): the endpoint's registry name, unique per
  endpoint, and the introspection handle via endpoint::whereis(name).
- serve* keep their meaning as the batteries-included path: they build a
  one-child tree around endpoint() with Shutdown::Infinity. Handle stays
  (a serve* caller has no RuntimeHandle to reach for) and now backs a real
  park instead of a poll.

Tests: 4 drain tests ported onto a real endpoint (bound socket, supervised
child, request_shutdown driven); new integration test boots an app tree
with an ordered sibling and asserts serve-then-drain, reverse-order
teardown and a closed port. 106 lib + 50 integration green.

src/conn_actor.rs

@@ -14,7 +14,7 @@
 //! during those parks, other connection actors progress freely.
 
 use crate::conn::{Body, Conn, HttpVersion, RespBody, StreamBody};
-use crate::conn_registry::{Cast, ConnRegistry, DeregisterGuard};
+use crate::endpoint::{Cast, DeregisterGuard, Endpoint};
 use crate::net::OwnedFd;
 use crate::parser::{self, ParseError};
 use crate::plug::Pipeline;
@@ -115,7 +115,7 @@ pub fn run_connection(
     fd: OwnedFd,
     pipeline: Pipeline,
     limits: ConnLimits,
-    registry: GenServerRef<ConnRegistry>,
+    registry: GenServerRef<Endpoint>,
 ) {
     // The OwnedFd cleans up via Drop on any exit path (panic, error, or
     // normal close). No explicit close calls below.
@@ -125,7 +125,7 @@ pub fn run_connection(
     // Self-register (initially idle: no request head parsed yet) and arm
     // the deregistration guard. Both casts come from this actor, so
     // Started always precedes Ended in the registry's inbox — see
-    // conn_registry module docs for why the listener must not do this.
+    // endpoint module docs for why the listener must not do this.
     let me = smarm::self_pid();
     let _ = registry.cast(Cast::ConnStarted(me));
     let _guard = DeregisterGuard::new(registry.clone(), me, Cast::ConnEnded);