docs: document graceful job kill/stop and job.terminate_interval (bug-1957)

- src/docs/xce.md: explicit signal and force kill are REST-only (signal,
  force_kill); xcecli has no signal option yet.
- src/docs/deployment.md: app.yaml row lists the job block
  (max_array_size, terminate_interval) and trusted proxies.
- xcecli jobs kill/stop/resume help describes the signal sequences.
- REST: control endpoint annotations and the signal/force_kill model fields
  describe the behaviour (swagger output not regenerated: swag fails on an
  unrelated annotation).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/docs/xce.md

@@ -64,8 +64,9 @@ Job control follows LSF's TERMINATE and SUSPEND actions:
 - **Stop** (`xcecli jobs stop <id>`): SIGTSTP first, so the job can catch
   it, prepare and stop itself; SIGSTOP follows after the interval if it has
   not stopped. **Resume** sends SIGCONT and cancels a stop still in progress.
-- **Explicit signal** (kill with a signal): that signal only, once.
-- **Force kill**: SIGKILL at once.
+- **Explicit signal**: that signal only, once (REST API: `signal` in the
+  control request, kill action; `xcecli` has no signal option yet).
+- **Force kill**: SIGKILL at once (REST API: `force_kill: true`).
 
 The interval is the API server's `job.terminate_interval` setting
 (`config/app.yaml`, seconds; default 10 when unset or 0, as LSF's