run.sh: actually restart the server

- pkill TERM alone never worked: uvicorn's graceful shutdown waits for
  in-flight /stream requests (minutes long), so the old process held
  the port and each new one died with EADDRINUSE — meaning the live
  server was running days-old code while the static files (read from
  disk per request) were current
- SIGKILL fallback after the 1s grace, and --timeout-graceful-shutdown
  3 so TERM is reliable on its own going forward
- this is why the new heatmap rendered an empty grid: the stale
  process served /api/stats without by_day

run.sh

@@ -3,7 +3,10 @@
 cd "$(dirname "$0")" || exit 1
 [ -x .venv/bin/python ] || { echo "no .venv — run: uv venv .venv && uv pip install --python .venv/bin/python -r requirements.txt"; exit 1; }
 pkill -f "uvicorn .*app:app" 2>/dev/null; sleep 1
+# graceful shutdown waits for in-flight /stream requests; force-kill anything
+# still holding the port, or the old process outlives the restart
+pkill -9 -f "uvicorn .*app:app" 2>/dev/null
 # ANIWEB_SECURE=1: session cookie is Secure — only usable via the HTTPS
 # proxy (plain http://<this machine>:8321 can no longer hold a session).
-ANIWEB_SECURE=1 nohup .venv/bin/python -m uvicorn server.app:app --host 0.0.0.0 --port 8321 > server.log 2>&1 &
+ANIWEB_SECURE=1 nohup .venv/bin/python -m uvicorn server.app:app --host 0.0.0.0 --port 8321 --timeout-graceful-shutdown 3 > server.log 2>&1 &
 echo "ani-web on http://localhost:8321 (pid $!) — use the HTTPS proxy to log in"