db-mode config changes apply live in-process

settings and upstream writes now follow a prepare, commit, publish, retire
contract: candidates are built and validated before the database transaction,
published as infallible pointer swaps, and old generations retire after their
readers drain. per-query policy values snapshot once per query; upstream pool,
cache, rate limiter, sessions, api limiter, log sink, blocklist scheduler and
the query-log queue each gained one named live operation. restart_required
shrinks from every scalar key to the bind keys and web.enabled; the admin ui
drops its restart notices for everything else. file mode is unchanged.

src/cli.zig

@@ -343,16 +343,13 @@ pub const DataDir = struct {
     }
 
     /// An additional connection to a `querylog.db` that `openQuerylogDb` has
-    /// already established. A running server needs two background ones — the
-    /// log writer and the retention pass each own one (`retention.zig`'s
-    /// contract) — plus a third for the web task when the web interface is
-    /// enabled.
+    /// already established, bound to this data directory's path.
+    ///
+    /// The opener itself is `querylog_schema.reopen`, beside the schema it
+    /// belongs to: a logger generation opens its own writer connection at
+    /// runtime and has no `DataDir` to ask.
     pub fn reopenQuerylogDb(self: *const DataDir, io: std.Io) !db.Db {
-        _ = io;
-        var database = try db.Db.open(self.querylog_db_path, .{ .mode = .read_write_existing });
-        errdefer database.close();
-        try db.applyPragmas(&database, .{});
-        return database;
+        return querylog_schema.reopen(io, std.Io.Dir.cwd(), self.querylog_db_path);
     }
 
     /// A sidecar that does not exist yet is not a failure: `-wal` and `-shm`