shutdown: close the sockets, or the database never gets sealed

mavend seals its encrypted database in `defer st.Close()` when run() returns.
It had not returned since 2026-07-21. Every restart since then decrypted the
same eleven-day-old ciphertext and rolled back everything written in between:
the Telegram nudge that kept firing was a fact being un-written on each boot.

The goroutine dump named it. main → srv.Close() → ipc.(*Server).Close →
wg.Wait(), waiting on per-connection goroutines parked in readFrame. Close
shut the listener and nothing else, so the idle persistent sockets held by
mavweb, mavpoll, mavcaldav and mavmaild blocked shutdown forever. `docker
compose stop -t 60` spent the whole sixty seconds and then took a SIGKILL.

So: track the accepted conns and close them, in ipc and in voice, which had
the identical defect. Bound all three waits — the two per-server ones and the
worker wait in main — because the seal matters more than any single in-flight
call. A dropped RPC costs one reply; a missed seal costs a session.

The regression test leaves a client connected and idle, which is the case the
old tests avoided by closing the client first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TrVSBKe3RFDF4fGYKWYQnX

internal/store/crypt.go

@@ -268,3 +268,34 @@ func zero(b []byte) {
 		b[i] = 0
 	}
 }
+
+// SealPlaintext encrypts an existing plaintext sqlite file at plainPath and
+// writes the ciphertext to cipherPath, atomically. key must be 32 bytes. The
+// plaintext file is left alone: this is a recovery path, and deleting the only
+// good copy of the data on the strength of a write that just succeeded is not
+// a trade worth making here.
+//
+// It exists for the case closeAndSeal cannot cover: a daemon that was killed
+// rather than shut down, leaving a live working copy in tmpfs and a stale
+// ciphertext on disk. mavseal folds the WAL in first, so what arrives here is
+// a single complete database.
+//
+// Nothing else should call this. The normal path is Close, which seals and
+// then wipes the plaintext and the key.
+func SealPlaintext(plainPath, cipherPath string, key []byte) error {
+	if len(key) != keyLen {
+		return ErrKeyLen
+	}
+	plain, err := os.ReadFile(plainPath)
+	if err != nil {
+		return fmt.Errorf("read working copy: %w", err)
+	}
+	blob, err := encrypt(key, plain)
+	if err != nil {
+		return fmt.Errorf("encrypt: %w", err)
+	}
+	if err := atomicWrite(cipherPath, blob); err != nil {
+		return fmt.Errorf("seal ciphertext: %w", err)
+	}
+	return nil
+}