db-mode config changes apply live in-process

settings and upstream writes now follow a prepare, commit, publish, retire
contract: candidates are built and validated before the database transaction,
published as infallible pointer swaps, and old generations retire after their
readers drain. per-query policy values snapshot once per query; upstream pool,
cache, rate limiter, sessions, api limiter, log sink, blocklist scheduler and
the query-log queue each gained one named live operation. restart_required
shrinks from every scalar key to the bind keys and web.enabled; the admin ui
drops its restart notices for everything else. file mode is unchanged.

src/web/handlers/mutations.zig

@@ -163,7 +163,11 @@ pub fn Resource(comptime desc: anytype) type {
     if (!isNull(@TypeOf(desc.remove))) {
         const Remove = @TypeOf(desc.remove);
         if (removeTakesArena(Remove)) {
-            expectType("remove", Remove, fn (*server.WebState, std.Io, Allocator, i64) ?Failure);
+            if (removeIsFallible(Remove)) {
+                expectType("remove", Remove, fn (*server.WebState, std.Io, Allocator, i64) error{OutOfMemory}!?Failure);
+            } else {
+                expectType("remove", Remove, fn (*server.WebState, std.Io, Allocator, i64) ?Failure);
+            }
         } else {
             expectType("remove", Remove, fn (*server.WebState, std.Io, i64) ?Failure);
         }
@@ -227,10 +231,12 @@ pub fn Resource(comptime desc: anytype) type {
         }
 
         fn removeRow(state: *server.WebState, io: std.Io, request: *Request) HandlerError!void {
-            const failure = if (comptime removeTakesArena(@TypeOf(desc.remove)))
-                desc.remove(state, io, request.arena, request.id.?)
+            const failure = if (comptime !removeTakesArena(@TypeOf(desc.remove)))
+                desc.remove(state, io, request.id.?)
+            else if (comptime removeIsFallible(@TypeOf(desc.remove)))
+                try desc.remove(state, io, request.arena, request.id.?)
             else
-                desc.remove(state, io, request.id.?);
+                desc.remove(state, io, request.arena, request.id.?);
 
             if (failure) |value| return respondFailure(request, value, remove_what);
             return http_util.respondEmpty(request, .no_content);
@@ -246,6 +252,14 @@ fn removeTakesArena(comptime T: type) bool {
     return @typeInfo(T) == .@"fn" and @typeInfo(T).@"fn".params.len == 4;
 }
 
+/// A delete decision that builds a candidate for the running server allocates
+/// while it does so, so it may run out of memory. The two shapes are checked
+/// exactly, so a `remove` that returns some other error set is still a compile
+/// error naming what it should have been.
+fn removeIsFallible(comptime T: type) bool {
+    return @typeInfo(@typeInfo(T).@"fn".return_type.?) == .error_union;
+}
+
 fn expectType(comptime name: []const u8, comptime Actual: type, comptime Expected: type) void {
     if (Actual != Expected) @compileError("resource descriptor `" ++ name ++ "` must be " ++
         @typeName(Expected) ++ ", found " ++ @typeName(Actual));