milestone 10: doh and dot listeners, cert store with hot reload and cert reload api

src/web/server.zig

@@ -33,10 +33,13 @@ const Allocator = std.mem.Allocator;
 const address = @import("../platform/address.zig");
 const api_limiter = @import("api_limiter.zig");
 const auth = @import("auth.zig");
+const cert_store = @import("../server/cert_store.zig");
 const clients = @import("../server/clients.zig");
 const db = @import("../storage/db.zig");
 const disk_monitor = @import("../storage/disk_monitor.zig");
 const dns_handler = @import("../server/handler.zig");
+const doh_server = @import("../server/doh_server.zig");
+const dot_server = @import("../server/dot_server.zig");
 const http_util = @import("http_util.zig");
 const local_tables_mod = @import("../server/local_tables.zig");
 const logger_mod = @import("../storage/logger.zig");
@@ -138,6 +141,16 @@ pub const WebState = struct {
     /// live-query handler subscribes.
     hub: ?*sse.Hub = null,
     sink: ?*query_sink.QuerySink = null,
+    /// The DoH/DoT certificate stores; null while an endpoint is disabled.
+    /// `POST /api/certs/reload` reloads through these, and `/metrics` reads
+    /// their counters (milestone-10 rulings 8 and 10).
+    doh_certs: ?*cert_store.CertStore = null,
+    dot_certs: ?*cert_store.CertStore = null,
+    /// The DoH/DoT listeners themselves; null while an endpoint is disabled
+    /// or its bind failed. `/metrics` reads their connection counters
+    /// (milestone-10 ruling 10).
+    doh_listener: ?*doh_server.DohServer = null,
+    dot_listener: ?*dot_server.DotServer = null,
 
     /// The web task's own connections (m7 ruling 21) — never the DNS path's.
     config_db: ?*db.Db = null,