fix(jupyterhub): make the hub stop timeout configurable and warn about surviving servers

When the hub stops, it stops the single-user servers one at a time. Podman kills the hub after 10 s, so with many servers, some servers continue to run with the old image. The next hub adopts them.

• Add jupyterhub.main_hub.stop_timeout. If it is set, the hub quadlet gets StopTimeout= and systemd gets a TimeoutStopSec= that is 30 s longer. By default, nothing changes.
• juice install --restart stops the hub with the configured timeout before it restarts it, because a running container keeps its old stop timeout.
• The warning gives a podman kill command for them and tells the administrator to set the timeout.Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

Closes #426 (closed)