db-mode config changes apply live in-process

settings and upstream writes now follow a prepare, commit, publish, retire
contract: candidates are built and validated before the database transaction,
published as infallible pointer swaps, and old generations retire after their
readers drain. per-query policy values snapshot once per query; upstream pool,
cache, rate limiter, sessions, api limiter, log sink, blocklist scheduler and
the query-log queue each gained one named live operation. restart_required
shrinks from every scalar key to the bind keys and web.enabled; the admin ui
drops its restart notices for everything else. file mode is unchanged.

src/config/model.zig

@@ -380,10 +380,6 @@ pub fn sessionTtlSeconds(w: Web) i64 {
     return @as(i64, w.session_ttl_hours) * 3600;
 }
 
-pub fn retentionSeconds(l: Logging) i64 {
-    return @as(i64, l.retention_days) * 86400;
-}
-
 pub fn maxLogBytes(l: Logging) u64 {
     return @as(u64, l.max_size_mb) * 1024 * 1024;
 }
@@ -840,7 +836,6 @@ test "unit conversions" {
         totalTimeout(.{}).nanoseconds,
     );
     try testing.expectEqual(@as(i64, 24 * 3600), sessionTtlSeconds(.{}));
-    try testing.expectEqual(@as(i64, 30 * 86400), retentionSeconds(.{}));
     try testing.expectEqual(@as(u64, 50 * 1024 * 1024), maxLogBytes(.{}));
     try testing.expectEqual(@as(u64, 200 * 1024 * 1024), minFreeBytes(.{}));
     try testing.expectEqual(@as(u64, 500 * 1024 * 1024), warnFreeBytes(.{}));
@@ -865,10 +860,6 @@ test "unit conversions at the field maximum do not overflow" {
         @as(i64, std.math.maxInt(u16)) * 3600,
         sessionTtlSeconds(.{ .session_ttl_hours = std.math.maxInt(u16) }),
     );
-    try testing.expectEqual(
-        @as(i64, std.math.maxInt(u16)) * 86400,
-        retentionSeconds(.{ .retention_days = std.math.maxInt(u16) }),
-    );
     try testing.expectEqual(
         @as(u64, std.math.maxInt(u32)) * 1024 * 1024,
         maxLogBytes(.{ .max_size_mb = std.math.maxInt(u32) }),