fix Windows shutdown safety and bound active connection drain

[sachahjkl]

Summary

• restore the worker thread's original temp allocator before destroying the default temp allocator on shutdown
• avoid touching thread-local d from the SIGINT handler by using the server closing flag instead
• make graceful shutdown bounded by periodically waking the event loop and force-closing active connections after a short grace period

Repro

• on Windows, start a server using server_shutdown_on_interrupt
• make one or more browser requests, then press Ctrl-C
• before this change, shutdown could hang until the browser refreshed or a live connection changed state
• there was also an unsafe SIGINT path that dereferenced thread-local server state outside a server thread

Notes

• this keeps the existing graceful shutdown behavior first, then force-closes stragglers after a short delay
• verified in an app vendoring odin-http where shutdown was previously unreliable after browser requests