fix(summer): forward SIGINT and SIGTERM to the app binary

- runAppBinary registers SIGINT and SIGTERM after its build and recursion
  checks and runChild forwards each signal to the app binary, then waits
  for it to exit, so stopping summer serve frees the port (WR-08)
- newAppCmd keeps the inherited stdin, env and output, and a context
  cancel sends SIGTERM with a 15-second appShutdownGrace before SIGKILL
- the child stays in summer's process group so the admin password
  prompts can read the terminal
- helper-process tests cover SIGINT, SIGTERM and context cancel
- console introduction notes the signal forwarding

cmd/summer/runtime.go

@@ -2,11 +2,16 @@ package main
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
+	"os/signal"
 	"path/filepath"
 	"strings"
+	"syscall"
+	"time"
 
 	"git.golem15.com/golem15/summercms/internal/build"
 	"git.golem15.com/golem15/summercms/modules/bonfire"
@@ -95,16 +100,70 @@ func runAppBinary(ctx context.Context, argv []string, out bonfire.Output) error
 			return fmt.Errorf("summer: refusing to recurse into %s", bin)
 		}
 	}
+	cmd := newAppCmd(ctx, bin, appDir, argv, out)
+	sigs := make(chan os.Signal, 2)
+	signal.Notify(sigs, os.Interrupt, syscall.SIGTERM)
+	defer signal.Stop(sigs)
+	if err := runChild(cmd, sigs); err != nil {
+		return fmt.Errorf("summer: %s: %w", strings.Join(argv, " "), err)
+	}
+	return nil
+}
+
+// appShutdownGrace is how long a cancelled app binary may take to exit after
+// SIGTERM before it is killed. It is longer than the 10-second shutdown
+// timeout of serve and the workers, so they finish a graceful shutdown.
+const appShutdownGrace = 15 * time.Second
+
+// newAppCmd builds the command that runs the app binary bin with argv in dir.
+// The child inherits summer's stdin, so the hidden password prompts of
+// admin:create and admin:reset-password read from the terminal. Cancelling
+// ctx sends SIGTERM, and the child is killed only after appShutdownGrace.
+func newAppCmd(ctx context.Context, bin, dir string, argv []string, out io.Writer) *exec.Cmd {
 	cmd := exec.CommandContext(ctx, bin, argv...)
-	cmd.Dir = appDir
+	cmd.Dir = dir
 	cmd.Stdout = out
 	cmd.Stderr = out
 	cmd.Stdin = os.Stdin
 	cmd.Env = os.Environ()
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("summer: %s: %w", strings.Join(argv, " "), err)
+	cmd.Cancel = func() error {
+		err := cmd.Process.Signal(syscall.SIGTERM)
+		if err != nil && !errors.Is(err, os.ErrProcessDone) {
+			// SIGTERM is not supported everywhere (Windows); kill instead.
+			return cmd.Process.Kill()
+		}
+		return err
+	}
+	cmd.WaitDelay = appShutdownGrace
+	return cmd
+}
+
+// runChild starts cmd, forwards every signal received on sigs to it and
+// waits for it to exit, returning Wait's error. It never escalates to a kill:
+// the app binary decides how to shut down.
+//
+// Ctrl+C in a terminal delivers SIGINT to both summer and the child, because
+// they share the foreground process group, so the child may see SIGINT twice.
+// The app's NotifyContext-based shutdown tolerates that. The child is
+// deliberately not put in its own process group (Setpgid): a background
+// process group that reads the terminal gets SIGTTIN, which would break the
+// password prompts of admin:create and admin:reset-password.
+func runChild(cmd *exec.Cmd, sigs <-chan os.Signal) error {
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	done := make(chan error, 1)
+	go func() { done <- cmd.Wait() }()
+	for {
+		select {
+		case err := <-done:
+			return err
+		case sig := <-sigs:
+			// Best effort: the child may already have exited
+			// (os.ErrProcessDone) or the platform may not support sig.
+			_ = cmd.Process.Signal(sig)
+		}
 	}
-	return nil
 }
 
 func sameFile(a, b string) (bool, error) {