fix(entrypoint): graceful docker stop + cac-fpm error_log owner on first start

Graceful stop (cac, cac-fpm, shared-httpd, and form-sender which runs cac):
entrypoint.sh, entrypoint-fpm.sh and entrypoint-shared-httpd.sh end with bash
as PID 1 tailing logs. PID 1 only receives signals it has a handler for, so
docker stop's SIGTERM was dropped; docker waited the full 10s and SIGKILLed
apache / php-fpm mid-request (exit 137). The entrypoints now trap TERM/INT and
stop each daemon they started via the new scripts/stop-services.sh: httpd
graceful-stop (WINCH), php-fpm QUIT, crond TERM, each with a bounded wait and a
TERM/KILL fallback, budgets summing to < 10s, then exit 0. The log tail is
backgrounded + `wait`ed (and shared-httpd's 60s rescan sleep likewise) so the
trap runs immediately. Log streaming to docker logs is unchanged.

cac-fpm error_log: entrypoint-fpm.sh `touch`ed logs/php-fpm/error.log as root
AFTER its chown -R, so on a site's first start the pool (customer uid) could
not open it and PHP errors went out as FastCGI stderr to shared-httpd's log
until the next restart. The file is now created and chowned to the customer
right after the logs dir is made, before php-fpm starts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/entrypoint-shared-httpd.sh

@@ -59,11 +59,30 @@ fi
 # Start cron for log rotation
 /usr/sbin/crond
 
-# Tail Apache logs (becomes PID 1 process)
+# Graceful shutdown. bash is PID 1 here, and PID 1 only receives signals it
+# has a handler for, so without this trap `docker stop`'s SIGTERM was dropped:
+# docker waited the full 10s and SIGKILLed apache mid-request (exit 137), for
+# every site on the host at once. graceful-stop (WINCH) lets in-flight requests
+# finish; after 7s it falls back to TERM. Timeouts sum to < 10s so this
+# completes inside docker's default stop timeout.
+source /scripts/stop-services.sh
+TAIL_PID=""
+SLEEP_PID=""
+shutdown() {
+  trap - TERM INT
+  echo "entrypoint-shared-httpd: received stop signal, shutting down"
+  stop_service httpd /etc/httpd/run/httpd.pid WINCH 7 '^/usr/sbin/httpd'
+  stop_service crond /run/crond.pid TERM 1 '^/usr/sbin/crond'
+  [ -n "$SLEEP_PID" ] && kill "$SLEEP_PID" 2>/dev/null
+  [ -n "$TAIL_PID" ] && kill "$TAIL_PID" 2>/dev/null
+  exit 0
+}
+trap shutdown TERM INT
+
+# Tail Apache logs to docker logs.
 # Use a loop to pick up new log files as vhosts are added.
 # tail -f only watches files that exist at start time.
 touch /var/log/httpd/error_log
-TAIL_PID=""
 while true; do
   LOG_FILES=$(find /var/log/httpd/ -name '*.log' -o -name '*_log' 2>/dev/null | sort)
   if [ -n "$TAIL_PID" ]; then
@@ -72,6 +91,10 @@ while true; do
   fi
   tail -f $LOG_FILES &
   TAIL_PID=$!
-  # Re-check for new log files every 60 seconds
-  sleep 60
+  # Re-check for new log files every 60 seconds. Background + `wait` (not a
+  # foreground sleep) so a stop signal runs the trap immediately instead of
+  # after up to 60s.
+  sleep 60 &
+  SLEEP_PID=$!
+  wait "$SLEEP_PID"
 done