fix(apiserver): validate, default and document job.terminate_interval (bug-1957)

The loader now stores the effective interval (10 s when unset or 0, LSF's
JOB_TERMINATE_INTERVAL default) and refuses a negative one; app_schema.json
describes the setting; src/docs/xce.md documents kill/stop behaviour and
the interval.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/docs/xce.md

@@ -54,6 +54,23 @@ cluster. Common operations:
 Built as a standalone Go binary; communicates with the API server over
 its REST interface.
 
+## Killing and stopping jobs
+
+Job control follows LSF's TERMINATE and SUSPEND actions:
+
+- **Kill** (`xcecli jobs kill <id>`, no signal given): SIGINT, then SIGTERM,
+  then SIGKILL, one interval apart, each only while the job is still
+  running, so the job can catch SIGINT/SIGTERM and clean up.
+- **Stop** (`xcecli jobs stop <id>`): SIGTSTP first, so the job can catch
+  it, prepare and stop itself; SIGSTOP follows after the interval if it has
+  not stopped. **Resume** sends SIGCONT and cancels a stop still in progress.
+- **Explicit signal** (kill with a signal): that signal only, once.
+- **Force kill**: SIGKILL at once.
+
+The interval is the API server's `job.terminate_interval` setting
+(`config/app.yaml`, seconds; default 10 when unset or 0, as LSF's
+`JOB_TERMINATE_INTERVAL`; negative refuses startup).
+
 ## Job arrays
 
 A job array is a set of identical jobs (elements) submitted at once. XCE