fix(kms): send the Finish response before shutting down

[kvinwang]

Problem

Onboard.Finish called std::process::exit(0) from inside the RPC handler, so the
process died before Rocket could write the response. The onboarding client saw an EOF /
connection reset and could not tell whether finalization had succeeded.

Fix

Use Rocket's graceful shutdown, which is what the web UI's GET /finish route has always
done. Rocket finishes in-flight responses and then stops accepting connections, so the
client gets its response. run_onboard_service returns normally afterwards and main
continues into the regular KMS startup path — the same thing that already happens after
the web-UI flow, so no caller sees new behavior.

The shutdown handle only exists after ignition, so the launch is split into ignite() and
launch() with the handle stashed in OnboardState in between. It is written once, before
any request can be served, so a OnceLock is enough.

Scope change since the first revision

The earlier revision also rewrote JSON null response bodies to an empty body in
ra-rpc/src/rocket_helper.rs. That has been dropped from this PR: it was a
transport-layer workaround for a codec-layer problem, and it silently changed the wire
format of every unit-returning RPC in vmm and gateway, which does not belong in a KMS
fix. It is being fixed properly upstream in prpc instead
(Phala-Network/prpc#1), where codegen emits an empty body
for unit responses so the JSON codec matches the protobuf codec. dstack will pick it up
with a prpc-build bump in a separate PR.

This PR is no longer stacked: #874 is merged, so it targets master directly.

Verification

• cargo clippy -p dstack-kms --all-features: clean.
• cargo fmt: clean.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.