fix(api,shared): do not report server-initiated cancellation as client-closed (499)

[AdaAibaby]

Problem

Fixes #3685.

The request middleware decided a request was "client closed" (499) purely from errors.Is(cancelCause, context.Canceled). But context.Canceled only means some context in the chain was cancelled — not that the client disconnected. The API server roots every request at a base context (main.go, http.Server.BaseContext) whose cancel() fires on process teardown. When that happens, in-flight requests see plain context.Canceled (not ErrRequestTimeout), so the server's own teardown was logged/recorded/traced as a 499 client closed.

The timeout path already had a dedicated cause (ErrRequestTimeout → 408); server-initiated cancellation had none, so it fell into the context.Canceled catch-all across all three middleware sites (logging.go, otel/metrics, otel/tracing).

Changes

• shared/pkg/middleware/timeout.go: add ErrServerShuttingDown (a cancel cause a server sets on the parent of every request context on teardown), plus IsClientDisconnect / IsServerShutdown classifiers. The server-side causes are checked first because both satisfy errors.Is(_, context.Canceled) once they propagate as a cancellation.
• logging / metrics / tracing middleware: classify via the helpers. A request cut by server teardown keeps its real status and is tagged server_shutdown instead of being counted as a 499 client disconnect. Client disconnect behaviour is unchanged.
• api/main.go: root the request context with context.WithCancelCause and cancel it with ErrServerShuttingDown, so the cause propagates through BaseContext and the per-request timeout wrapper into the middleware.

Scope note: this PR covers the server-vs-client misattribution (part 1 of the issue). The second facet — handler-level ReportCriticalError ERROR logs / span exception events not being reconciled with the 499 reclassification — is left for a follow-up, since #3683/#3684 already removed the main offender on the sandbox-create path.

Tests

• TestClassifyCancelCause: table test for IsClientDisconnect / IsServerShutdown across nil, client disconnect (incl. wrapped), request timeout, server shutdown (incl. wrapped), deadline-exceeded and unrelated errors.
• TestServerShutdownCausePropagatesToOuterMiddleware: end-to-end — a request whose parent context is cancelled with ErrServerShuttingDown surfaces that cause through the RequestTimeout wrapper to an outer middleware, classified as server shutdown, not client disconnect. (I separately verified via a throwaway net/http probe that a BaseContext cancel-cause does reach r.Context().)
• go test ./pkg/middleware/... passes; go vet and golangci-lint clean on the changed packages; both packages/shared and packages/api build.