chore(deps): [#2234] update torrust-server-lib lifecycle API

[josecelano]

Summary

• Update all tracker consumers to the published torrust-server-lib 0.3.0 release, which adds the additive cancellation_signal(CancellationToken) wait primitive.
• Add an axum-server contract test that compiles and resolves the released primitive through token cancellation without delivering an OS signal; legacy Halted consumers are intentionally unchanged.
• Record upstream release provenance, tracker validation, self-contained manual configuration, and independent completion review evidence for issue Add token-aware server lifecycle API #2234.

Scope

• Updated root and server-package manifests plus Cargo.lock to resolve the crates.io 0.3.0 release.
• Added the focused contract test in packages/axum-server/src/signals.rs.
• Updated issue-local specification, manual verification evidence, and reviewer report.
• Does not migrate server consumers or introduce a joinable drain controller; SI-10 and subsequent component migrations own that work.

Validation

• cargo test -p torrust-tracker-axum-server it_should_compile_and_resolve_the_server_lib_cancellation_signal_when_token_is_cancelled
• cargo test -p torrust-tracker-axum-server
• cargo machete --with-metadata
• linter all
• cargo test --doc --workspace
• cargo check --workspace
• Mandatory pre-commit and pre-push suites, including nightly workspace checks, documentation build, and full tests
• Direct-binary manual verification: clean legacy SIGINT, two same-port direct SIGTERM shutdown/restart cycles, and token-only contract test; the complete temporary configuration is retained in tracked issue evidence. Local .tmp configuration and logs are not included in this PR.

Closes #2234

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.40%. Comparing base (678aa31) to head (1c0459c).
⚠️ Report is 5 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #2236   +/-   ##
========================================
  Coverage    85.39%   85.40%           
========================================
  Files          353      353           
  Lines        31315    31321    +6     
  Branches     31315    31321    +6     
========================================
+ Hits         26743    26751    +8     
+ Misses        4190     4188    -2     
  Partials       382      382           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟡 Changes recommended

Unresolved documentation metadata issues and a missing timeout for the cancellation contract test remain.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates tracker dependencies to torrust-server-lib 0.3.0 and adds cancellation API contract coverage while leaving legacy shutdown consumers unchanged.

Changes:

• Updates manifests and Cargo.lock.
• Adds an axum-server cancellation contract test.
• Records release, verification, and review evidence; removes superseded drafts.

File summaries

File	Description
packages/udp-server/Cargo.toml	Updates the server library dependency.
packages/axum-server/src/signals.rs	Adds cancellation API contract coverage.
packages/axum-server/Cargo.toml	Updates the server library dependency.
packages/axum-rest-api-server/Cargo.toml	Updates the server library dependency.
packages/axum-http-server/Cargo.toml	Updates the server library dependency.
packages/axum-health-check-api-server/Cargo.toml	Updates the server library dependency.
docs/pr-reviews/pr-2236-review.md	Records the PR review evidence.
docs/issues/open/2234-1488-si-2-remove-global-shutdown-signal/manual-verification-evidence.md	Records manual verification evidence.
docs/issues/open/2234-1488-si-2-remove-global-shutdown-signal/ISSUE.md	Adds the promoted issue specification.
docs/issues/open/2234-1488-si-2-remove-global-shutdown-signal/agent-review-reports.md	Records completion review evidence.
docs/issues/open/1488-overhaul-tracker-shutdown/ISSUE.md	Updates shutdown roadmap linkage.
docs/issues/drafts/1488-si-2-remove-global-shutdown-signal/verification.md	Removes the superseded verification document.
docs/issues/drafts/1488-si-2-remove-global-shutdown-signal/ISSUE.md	Removes the superseded draft issue.
Cargo.toml	Updates the workspace dependency.
Cargo.lock	Resolves torrust-server-lib 0.3.0.

Review details

Suppressed comments (5)

docs/issues/open/2234-1488-si-2-remove-global-shutdown-signal/ISSUE.md:11

• The frontmatter timestamp is 09:30, while this document's latest progress entry records 2026-09-16 10:50 UTC at line 145. The metadata is therefore stale; update it to the latest documented change time.

last-updated-utc: 2026-09-16 09:30

docs/issues/open/2234-1488-si-2-remove-global-shutdown-signal/ISSUE.md:10

• This spec is being delivered by PR #2236 (as recorded in docs/pr-reviews/pr-2236-review.md), but its machine-readable related-pr field remains null. Existing issue specs populate this field once a delivery PR exists, so set it to the current PR number.

related-pr: null

docs/issues/open/2234-1488-si-2-remove-global-shutdown-signal/ISSUE.md:16

• This PR deletes docs/issues/drafts/1488-si-2-remove-global-shutdown-signal/ISSUE.md, but six remaining draft specs still reference that exact path in their frontmatter (for example SI-11, SI-12, SI-13, SI-14, SI-16, and SI-18), so those links become broken. Update all of those references to the new open path or to the stable issue #2234 form before removing the draft path.

    - docs/issues/open/1488-overhaul-tracker-shutdown/ISSUE.md

docs/issues/open/2234-1488-si-2-remove-global-shutdown-signal/manual-verification-evidence.md:4

• The canonical manual-verification template and the existing issue-local evidence files use the issue-spec frontmatter key, not spec-path. Rename this key so tooling and readers following the repository convention can resolve the owning issue specification.

spec-path: docs/issues/open/2234-1488-si-2-remove-global-shutdown-signal/ISSUE.md

packages/axum-server/src/signals.rs:66

• This unbounded await can hang the entire package test run if the released primitive stops completing—the failure mode this contract test is meant to detect. Existing cancellation tests bound awaits with tokio::time::timeout (for example, packages/swarm-coordination-registry/src/statistics/activity_metrics_updater.rs:140-142); add a short timeout and enable the required Tokio time feature so the test fails deterministically.

        wait_task.await.expect("cancellation signal should resolve");

• Files reviewed: 14/15 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.