auth, storage, constellation ignore SIGTERM, rolling updates hard-kill in-flight requests

On EKS-style rollouts kubelet sends SIGTERM and waits terminationGracePeriodSeconds before SIGKILL. I checked serve loops in auth, storage and constellation and they all use plain context.WithCancel with no signal handling, so SIGTERM is never observed and the process only exits on SIGKILL.

What I found:

• services/auth/go/cmd/serve.go serve() builds servCtx with context.WithCancel and blocks on <-servCtx.Done(), which only unblocks when ListenAndServe itself fails.
• services/storage/cmd/serve.go has the same pattern, and Shutdown uses a context without timeout handling.
• services/constellation/cmd/serve.go shadows ctx with context.WithCancel and never wires SIGINT/SIGTERM.
• services/mcp/server/server.go already does it right with signal.NotifyContext, so there is an in-repo pattern to copy.

Impact: every deployment/scale-down drops in-flight auth sign-ins, storage uploads and GraphQL queries as 502s, and skips pool.Close / imageTransformer.Shutdown / connector close paths.

Proposed fix: wrap the serve context with signal.NotifyContext for SIGINT/SIGTERM in all three services (same one-line pattern as mcp), keep the existing 30s shutdown timeout.