log.Fatal(http.ListenAndServe) ignores ctx cancellation, so SIGTERM from
systemd hung the process until TimeoutStopSec (90s) triggered SIGKILL.
Replace with explicit *http.Server + Shutdown(ctx) driven by the existing
signal.NotifyContext ctx so restarts complete in under a second.
Previously only the *replaced* value was closed on swap — the
*currently-held* value leaked on process exit. Adds:
- View.Close() — closes the held value (if it implements io.Closer)
and clears the pointer; idempotent.
- Set.Close() — joins Close errors across all views in the set.
form2mail defers geoSet.Close() to release the geoip2 file handles on
shutdown.
`any(typedNilPtr)` wraps the nil pointer in a non-nil interface, so the
prior `closer != nil` check didn't catch it — calling Close on the
underlying nil *geoip.Databases segfaulted during the first successful
reload after a failed one.
Also flip form2mail's default blocklist URL from git@ (SSH) to
https:// so fresh deployments work without a GitHub SSH key.
