fix(service): supervise canonical Mission Core lifecycle

src/k1link/device_plugins/xgrids_k1/cli.py

@@ -81,6 +81,7 @@ from k1link.device_plugins.xgrids_k1.protocol.application_authority import (
 )
 from k1link.device_plugins.xgrids_k1.usb.snapshot import snapshot as usb_snapshot
 from k1link.macos_credentials import CredentialDialogError, prompt_wifi_credentials
+from k1link.service_watchdog import MissionCoreSelfWatchdog, watchdog_enabled
 from k1link.sessions import SessionIntegrityError
 
 app = typer.Typer(
@@ -116,6 +117,7 @@ app.add_typer(artifact_app, name="artifact")
 
 _CANONICAL_MISSION_CORE_PORT = 8000
 _MISSION_CORE_SERVE_LOCK_FILENAME = ".serve.lock"
+_MISSION_CORE_GRACEFUL_SHUTDOWN_SECONDS = 10
 
 
 class _MissionCoreServeLeaseError(RuntimeError):
@@ -1166,13 +1168,23 @@ def serve_console(
             f"NODEDC MISSION CORE: http://127.0.0.1:{_CANONICAL_MISSION_CORE_PORT}"
         )
         console.print("The credential endpoint is bound to this Mac only.")
-        uvicorn.run(
-            "k1link.web.app:app",
-            host="127.0.0.1",
-            port=_CANONICAL_MISSION_CORE_PORT,
-            log_level="info",
-            access_log=True,
+        watchdog = (
+            MissionCoreSelfWatchdog(repository_root) if watchdog_enabled() else None
         )
+        if watchdog is not None:
+            watchdog.start()
+        try:
+            uvicorn.run(
+                "k1link.web.app:app",
+                host="127.0.0.1",
+                port=_CANONICAL_MISSION_CORE_PORT,
+                log_level="info",
+                access_log=True,
+                timeout_graceful_shutdown=_MISSION_CORE_GRACEFUL_SHUTDOWN_SECONDS,
+            )
+        finally:
+            if watchdog is not None:
+                watchdog.stop()
 
 
 def _print_existing_mission_core(port: int) -> None: