db-mode config changes apply live in-process

settings and upstream writes now follow a prepare, commit, publish, retire
contract: candidates are built and validated before the database transaction,
published as infallible pointer swaps, and old generations retire after their
readers drain. per-query policy values snapshot once per query; upstream pool,
cache, rate limiter, sessions, api limiter, log sink, blocklist scheduler and
the query-log queue each gained one named live operation. restart_required
shrinks from every scalar key to the bind keys and web.enabled; the admin ui
drops its restart notices for everything else. file mode is unchanged.

src/server/doh_server.zig

@@ -36,6 +36,7 @@ const listener = @import("listener.zig");
 const model = @import("../config/model.zig");
 const tls_server = @import("../platform/tls_server.zig");
 const transport = @import("../upstream/transport.zig");
+const upstream_owner = @import("../upstream/owner.zig");
 
 pub const dns_query_path = "/dns-query";
 
@@ -619,6 +620,7 @@ const Harness = struct {
     store: cert_store.CertStore,
     tables: local_tables_mod.LocalTables,
     upstream: FailingUpstream,
+    upstream_owner: upstream_owner.Borrowed,
     h: handler.Handler,
     server: DohServer,
     group: std.Io.Group,
@@ -646,10 +648,10 @@ const Harness = struct {
         errdefer hx.tables.deinit(testing.allocator);
 
         hx.upstream = .{};
+        hx.upstream_owner = .{};
         hx.h = .{
-            .upstream = hx.upstream.client(),
-            .blocking = test_blocking,
-            .forward_read_timeout = test_forward_timeout,
+            .upstream = hx.upstream_owner.client(hx.upstream.client()),
+            .policy = .{ .blocking = test_blocking, .forward_read_timeout = test_forward_timeout },
             .local_tables = &hx.tables,
         };