fix(api): flush the summary-access coalescer at lifespan shutdown (BACKLOG #1640)

[wshallwshall]

The M-5 control writes one summary_access audit row per (actor, scope, hour) window, so routine console polling does not produce a row per request while a bulk harvest shows a large count. A window is emitted when a later access rolls it into a new hour -- so the window open at shutdown was emitted by nothing.

_SummaryAuditCoalescer.flush existed and documented itself as the engine-shutdown path. Nothing called it. Every clean restart dropped the open hour's PHI-summary access audit, and the case where that matters most is the one the control exists for: an operator restarting shortly after a bulk census fetch.

Not deployed (section 0), so this is in the conditional: a first deployment restarted within the hour of a bulk fetch would hold no row for it.

Where, and why the order is load-bearing

The flush runs in the lifespan finally, before engine.stop(), because that ends in store.close() and the emit needs the store.

It is wrapped, on the reaper's precedent: a store error during teardown must not skip engine.stop(). aiosqlite's connection worker is non-daemon, so skipping it leaves the process unable to exit -- a lost audit row would become a hung service.

The control, run rather than asserted

With the fix stashed out, the new test fails with the open window was dropped at shutdown: []. With it restored, 3 pass.

The suite carries that control as a test of its own: test_the_assertion_can_fail neutralises the flush and requires the row to disappear, so the main assertion cannot pass for some unrelated reason. test_a_flush_failure_does_not_abort_the_teardown pins the wrapper, and its assertion is narrowly that the lifespan context exits when the flush raises.

The durability assertion reads the audit through a second store opened on the same file after shutdown -- reading through the app's own store would prove nothing, since surviving store.close() is the property under test.

Checks

Check	Result
ruff check	pass
ruff format --check	pass
mypy (strict)	pass, on the module and the new test
New tests	3 passed
Existing regression	13 passed (test_api.py -k "summary or audit or lifespan")

Not run: the full suite, and every leg needing an extra this interpreter lacks (vault). Those must be read on the runner.

The venv used is the primary checkout's. messagefoundry.__file__ was confirmed to resolve to this worktree and to contain the change before any result was trusted -- an editable install can be a copy, and green over the wrong tree means nothing.

Ledger

#1640 is not edited here. Banner text for the Lander:

SHIPPED: the coalescer is flushed in the lifespan finally before engine.stop(), guarded so a flush failure cannot abort the teardown. Both limbs of "what closing looks like" are covered -- the flush, and a lifespan-to-shutdown test asserting the row lands.

[wshallwshall]

Note for review: this same commit also currently sits on claude/trusting-davinci-eb272a (PR #1226), because it was committed there before being moved to its own branch. This PR is the one to review for #1640 -- it is the single change, nothing else.

Whichever merges first makes the other's copy redundant; there is no conflict.