milestone 10: doh and dot listeners, cert store with hot reload and cert reload api

src/web/openapi.yaml

@@ -1463,6 +1463,25 @@ paths:
         "503":
           $ref: "#/components/responses/Unavailable"
 
+  /api/certs/reload:
+    post:
+      summary: Reload the TLS certificates from disk
+      description: |
+        Reloads the certificate and key of every enabled DoH/DoT endpoint.
+        Always answers 200: the per-endpoint outcome is the payload, and a
+        failed reload leaves the previous certificate serving.
+      responses:
+        "200":
+          description: The outcome for each endpoint.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CertsReload"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "429":
+          $ref: "#/components/responses/RateLimited"
+
 components:
   securitySchemes:
     sessionCookie:
@@ -2044,6 +2063,29 @@ components:
           maximum: 604800
           description: Only meaningful with `paused = true`; absent means indefinite.
 
+    CertReloadOutcome:
+      type: object
+      required: [enabled, reloaded, error]
+      properties:
+        enabled:
+          type: boolean
+          description: Whether the endpoint is enabled in the configuration.
+        reloaded:
+          type: boolean
+        error:
+          type: string
+          nullable: true
+          description: Why the reload failed; null on success and while disabled.
+
+    CertsReload:
+      type: object
+      required: [doh, dot]
+      properties:
+        doh:
+          $ref: "#/components/schemas/CertReloadOutcome"
+        dot:
+          $ref: "#/components/schemas/CertReloadOutcome"
+
     Settings:
       type: object
       required: [runtime, upstream, dns, blocking, cache, web, doh_server, dot_server, edns, logging, disk, blocklist_update]