refactor(backend): extract bootstrap into startup/shutdown modules (phase 5) (#745)

Move the startup and shutdown lifecycles out of index.ts:
- bootstrap/startup.ts exports startServer(server) - migration check,
  service initialization, background watchdogs, HTTP listen, pilot-agent
  loopback bind.
- bootstrap/shutdown.ts exports installShutdownHandlers(server) -
  SIGTERM/SIGINT handlers, in-order service stop chain, 10s force-exit
  guard, SQLite close.

Restructure MfaService to add an instance + lifecycle so the replay
purge timer no longer lives as a module-scope setInterval in index.ts.
MfaService keeps all existing static methods (generateSecret, verifyTotp,
currentWindow, generateBackupCodes, hashBackupCodes, verifyBackupCode,
formatBackupCodeForDisplay, normalizeBackupCode, buildOtpauthUri) so
every existing caller stays unchanged. The new start() / stop() pair
is idempotent and calls .unref() so test shutdown is not blocked.

bootstrap/startup calls MfaService.getInstance().start().
bootstrap/shutdown calls MfaService.getInstance().stop().

index.ts drops from 305 to 147 lines and now contains only the Express
app composition: createApp, route mounts, remote proxy, createServer,
attachUpgrade, static/SPA fallback, errorHandler, installShutdownHandlers,
and the require.main guard that boots the server when run directly.

Behavior is byte-for-byte identical: shutdown service order, log
strings, force-exit timer, pilot-agent loopback logic, and the MFA
purge cadence and debug logging all preserved verbatim.

backend/src/bootstrap/shutdown.ts

@@ -0,0 +1,57 @@
+import type { Server } from 'http';
+import { DatabaseService } from '../services/DatabaseService';
+import { LicenseService } from '../services/LicenseService';
+import { MonitorService } from '../services/MonitorService';
+import { AutoHealService } from '../services/AutoHealService';
+import { DockerEventManager } from '../services/DockerEventManager';
+import { ImageUpdateService } from '../services/ImageUpdateService';
+import { SchedulerService } from '../services/SchedulerService';
+import { MfaService } from '../services/MfaService';
+
+/**
+ * Wire graceful shutdown handlers. Docker sends SIGTERM when the container
+ * stops; Ctrl-C sends SIGINT in dev. We allow in-flight requests to finish,
+ * then cleanly stop background services and close the SQLite connection
+ * before exiting. A 10 s force-exit timer guards against hung connections.
+ */
+export function installShutdownHandlers(server: Server): void {
+  const gracefulShutdown = (signal: string): void => {
+    console.log(`[Shutdown] ${signal} received - shutting down gracefully…`);
+
+    server.close(() => {
+      console.log('[Shutdown] HTTP server closed');
+      try { LicenseService.getInstance().destroy(); } catch (e) {
+        console.warn('[Shutdown] LicenseService cleanup failed:', (e as Error).message);
+      }
+      try { MonitorService.getInstance().stop(); } catch (e) {
+        console.warn('[Shutdown] MonitorService cleanup failed:', (e as Error).message);
+      }
+      try { AutoHealService.getInstance().stop(); } catch (e) { console.warn('[Shutdown] AutoHealService cleanup failed:', (e as Error).message); }
+      try { DockerEventManager.getInstance().stop(); } catch (e) {
+        console.warn('[Shutdown] DockerEventManager cleanup failed:', (e as Error).message);
+      }
+      try { ImageUpdateService.getInstance().stop(); } catch (e) {
+        console.warn('[Shutdown] ImageUpdateService cleanup failed:', (e as Error).message);
+      }
+      try { SchedulerService.getInstance().stop(); } catch (e) {
+        console.warn('[Shutdown] SchedulerService cleanup failed:', (e as Error).message);
+      }
+      try { MfaService.getInstance().stop(); } catch (e) {
+        console.warn('[Shutdown] MfaService cleanup failed:', (e as Error).message);
+      }
+      try { DatabaseService.getInstance().getDb().close(); } catch (e) {
+        console.warn('[Shutdown] Database close failed:', (e as Error).message);
+      }
+      console.log('[Shutdown] Done - exiting');
+      process.exit(0);
+    });
+
+    setTimeout(() => {
+      console.error('[Shutdown] Timed out waiting for connections - forcing exit');
+      process.exit(1);
+    }, 10_000).unref();
+  };
+
+  process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));
+  process.on('SIGINT', () => gracefulShutdown('SIGINT'));
+}

backend/src/bootstrap/startup.ts

@@ -0,0 +1,64 @@
+import type { Server } from 'http';
+import { FileSystemService } from '../services/FileSystemService';
+import { NodeRegistry } from '../services/NodeRegistry';
+import { LicenseService } from '../services/LicenseService';
+import SelfUpdateService from '../services/SelfUpdateService';
+import { MonitorService } from '../services/MonitorService';
+import { AutoHealService } from '../services/AutoHealService';
+import { DockerEventManager } from '../services/DockerEventManager';
+import TrivyService from '../services/TrivyService';
+import { ImageUpdateService } from '../services/ImageUpdateService';
+import { SchedulerService } from '../services/SchedulerService';
+import { MfaService } from '../services/MfaService';
+import { sweepStaleTempDirs as sweepStaleGitTempDirs } from '../services/GitSourceService';
+import { PORT } from '../helpers/constants';
+
+/**
+ * Run the startup sequence: stack-directory migration, service initialization,
+ * background watchdogs, then bind the HTTP server. The caller passes the
+ * already-constructed server so tests can import the module without binding a
+ * port.
+ */
+export async function startServer(server: Server): Promise<void> {
+  try {
+    console.log('Running stack migration check...');
+    const defaultFsService = FileSystemService.getInstance(NodeRegistry.getInstance().getDefaultNodeId());
+    await defaultFsService.migrateFlatToDirectory();
+    console.log('Migration check completed');
+  } catch (error) {
+    console.error('Migration failed:', error);
+  }
+
+  LicenseService.getInstance().initialize();
+
+  await SelfUpdateService.getInstance().initialize();
+
+  MonitorService.getInstance().start();
+  AutoHealService.getInstance().start();
+
+  await DockerEventManager.getInstance().start();
+
+  await TrivyService.getInstance().initialize();
+
+  ImageUpdateService.getInstance().start();
+
+  SchedulerService.getInstance().start();
+
+  sweepStaleGitTempDirs().catch((err) => {
+    console.warn('[GitSource] Temp dir sweep failed:', (err as Error).message);
+  });
+
+  MfaService.getInstance().start();
+
+  const isPilotAgent = process.env.SENCHO_MODE === 'pilot';
+  const listenHost = isPilotAgent ? '127.0.0.1' : undefined;
+
+  server.listen(PORT, listenHost, () => {
+    console.log(`Server running on ${listenHost || '0.0.0.0'}:${PORT}${isPilotAgent ? ' (pilot-agent mode)' : ''}`);
+    if (isPilotAgent) {
+      import('../pilot/agent').then((m) => m.startPilotAgent(PORT)).catch((err) => {
+        console.error('[Pilot] Agent startup failed:', err);
+      });
+    }
+  });
+}