Raise an exception if Server shutdown fails.

Rather than just log exceptions that happen during shutdown, we
carefullly catch and record them. Then after shutdown is complete, if
there was an exception during the process we re-raise it.

This change uncovered a couple of problems that were previously being
ignored. They are cases where tests call #stop() even though #start()
did not succeed. Those #stop() methods are now more defensive to cope
with that.