Call it draining on shutdown, not maintenance mode

Other systems keep two things apart: draining before a shutdown (ephemeral, cleared by the restart: RabbitMQ drain, CockroachDB node drain) and an operator's maintenance flag (persistent cluster state: Kubernetes cordon, Nomad eligibility, Consul maint). This PR is the former, so it is named that way: Server.Drain (synchronous again; the on/off API is gone until the persistent maintenance flag exists), Cluster.SetDraining/Draining, the read-only phase flag readOnly, /v1/ready reports "draining": true, error 50301 says the node is shutting down, and docs/config.md has a "Draining on shutdown" section. A drain duration of 0 now closes all streams at once instead of disabling the drain.

server/server.yml

@@ -87,14 +87,13 @@
 #   jobs, and it never closes its subscribers to send them elsewhere. Active nodes do not count
 #   it as a place to send theirs either. The member list reports each node's role, so load
 #   balancer agents can route to active nodes only.
-# - experimental-cluster-drain-delay and experimental-cluster-drain-duration control maintenance
-#   mode, which an active node enters on shutdown (SIGTERM) if another active node is up, so its
-#   clients move to the other nodes gradually instead of all at once. For the drain delay, the node
-#   is not ready (/v1/ready fails) but still serves everything, so the load balancer can stop
-#   sending it requests. Then it drains: it is read-only (new subscriptions and publishes get 503)
-#   and closes its subscriber connections evenly over the drain duration. Make sure the service
-#   manager waits long enough (systemd: TimeoutStopSec, default 90s). A drain duration of 0
-#   disables maintenance mode.
+# - experimental-cluster-drain-delay and experimental-cluster-drain-duration control how an active
+#   node drains on shutdown (SIGTERM) if another active node is up, so its clients move to the
+#   other nodes gradually instead of all at once. For the drain delay, the node is not ready
+#   (/v1/ready fails) but still serves everything, so the load balancer can stop sending it
+#   requests. Then it is read-only (new subscriptions and publishes get 503) and closes its
+#   subscriber connections evenly over the drain duration (all at once with 0). Make sure the
+#   service manager waits long enough (systemd: TimeoutStopSec, default 90s).
 #
 # Clustering also requires "database-url": the shared PostgreSQL database carries the durable
 # state and the cluster's own coordination tables.