Remove shutdown from protocol?

[dmeliza]

I'm not sure why we put this in there. I don't know what the use case is for clients to be able to shut down a controller. Currently the only way to start the controller is by connecting to the host via ssh, so this functionality could be removed. This would probably allow us to really simplify the logic for graceful shutdowns, e.g. using CancellationTokens from tokio_util.