fix(create-app): ship logger and shutdown in the scaffold, drop @o3co/auth.utils

[y1o1]

Both generators emitted @o3co/auth.utils into generated package.json, and both templates imported createLogger / gracefulShutdown from it. This was the package's last consumer across the auth family — auth.provider left in #290, auth.proxy in #81, auth.policy-verifier in #210.

Two defects this fixes in generated instances

They never logged NDJSON. @o3co/auth.utils treats pino as an optional peer and falls back to console when the import fails. The generator never emitted pino, so every instance created by either CLI has been logging bare [name] … console lines that no aggregator parses. The scaffold now ships src/logger.mts on pino — a direct, exact-pinned runtime dependency like the rest — honouring logging.level from the application config with LOG_LEVEL as the override, and serialising err so an Error keeps its stack.

They could hang on SIGTERM and always exited zero. gracefulShutdown called server.close() with no deadline; one stuck request meant the process never exited on its own and the orchestrator's SIGKILL cut it mid-flight. Cleanup failures went to console.error. The scaffold now ships src/shutdown.mts with the contract the three o3co components adopted: drain for drainTimeoutMs (10s), bound cleanup by cleanupTimeoutMs, force-close past the deadline and exit non-zero, log through the instance logger, yield the loop once before exiting so the last lines flush, and name in reason whatever set the exit code (drain outcome kept under its own drain key).

shutdown.mts declares a small structural Logger rather than importing one, so the template does not depend on which upstream version the generator pins.

What the scaffold typecheck caught

Run against the pinned module ref, the provider instance failed typecheck: the HOCON template carries logging.level but DplaaxAppConfig does not declare it. The template reads it defensively ((config as { logging?: { level?: string } }).logging?.level), same as the verifier template already did for its AppConfigSchema at the 0.3.x pin.

Verification

• Generator suites: 97 / 110 passed, four new cases — does not emit @o3co/auth.utils and emits pino per generator. The pino assertion is a literal "10.3.1", not DEFAULT_DEP_VERSIONS.pino: sharing the oracle with the implementation let a missing key pass as undefined === undefined on the first run.
• Generator typecheck and root lint clean.
• Both scaffolds generated with --dplaax-module-ref <origin/develop sha>, then inside each: pnpm install → pnpm run typecheck (exit 0) → pnpm run test (provider 18, policy-verifier 26). Emitted package.json: no @o3co/auth.utils, pino: 10.3.1, zero caret specifiers.
• No lockfile change: only generator source and templates moved.

docs/requirements.md § 6 and the CHANGELOG (Fixed ×2, Changed) are updated.

🤖 Generated with Claude Code