fix(server): start background tasks only after listen succeeds; health and static-file fixes

[amenjason936]

Problem

token-watcher serve without --port retries the next port on EADDRINUSE/EACCES (bin/tokenwatcher.js:282-300). startServer started all of its side effects before listen resolved:

• scanner update listeners
• the Claude/Cursor/ZCode/balance pollers
• backup timers
• the hourly leaderboard upload
• the 24 h price refresh

Every failed attempt therefore left a full copy running. One busy port means:

• every official-API poller runs twice
• backups run twice
• two leaderboard uploads per hour, and the Worker answers the second with 429. That 429 is stored as last_error, so the panel shows "上次上报失败" even though the first upload succeeded.

This was listed as a P2 in docs/RELEASE-READINESS-2026-09-24.md and is still present on main.

Change

• startServer: side effects move into startLifecycle(), which runs inside the listen callback. The signature and callers are unchanged.
• computeHealth: a parse error now outranks "empty". A source whose first scan fails is exactly the upstream-format-change case CONTRIBUTING.md warns about. It used to show as empty, and doctor passed it. Also a 2026-09-24 P2.
• serveFile: a read-stream error (file replaced between stat and open, e.g. during npm update -g) now destroys the response. Before, pipe didn't forward the error, so the request hung, and the stream emitted an unhandled error event.

Tests

test/server-lifecycle.mjs adds 16 checks, run in a child process with a temp HOME and TOKENMETER_OFFLINE=1, so they never touch a real ~/.tokenmeter.

• Busy port with injected pollers: after the failed attempt there are 0 poller starts, 0 listeners and 0 timers. After success, each starts exactly once.
• Production shape: bin passes only balancePoller, and the Claude/Cursor/ZCode pollers are built inside startServer. The test checks this case and counts one-off timers too: backup at 30 s, first upload at 90 s.
• Health ordering.
• serveFile hang.

12 of these checks fail against the current src/server.js. Full npm test passes on Node 22.22.

The four PRs in this set are independent. Each adds one registration line after stall-guard.mjs in test/run.mjs, so the second one merged will need a one-line rebase.

🤖 Generated with Claude Code