db-mode config changes apply live in-process

settings and upstream writes now follow a prepare, commit, publish, retire
contract: candidates are built and validated before the database transaction,
published as infallible pointer swaps, and old generations retire after their
readers drain. per-query policy values snapshot once per query; upstream pool,
cache, rate limiter, sessions, api limiter, log sink, blocklist scheduler and
the query-log queue each gained one named live operation. restart_required
shrinks from every scalar key to the bind keys and web.enabled; the admin ui
drops its restart notices for everything else. file mode is unchanged.

src/server/udp_server_integration_test.zig

@@ -20,6 +20,7 @@ const header = @import("../dns/header.zig");
 const packet = @import("../dns/packet.zig");
 const types = @import("../dns/types.zig");
 const transport = @import("../upstream/transport.zig");
+const upstream_owner = @import("../upstream/owner.zig");
 
 const testing = std.testing;
 
@@ -36,11 +37,10 @@ const forward_timeout: std.Io.Clock.Duration = .{
 /// An upstream and nothing else optional: no filtering, no cache, no log. The
 /// listener is what these tests exercise, so the handler is the same bare one
 /// its own tests use.
-fn bareHandler(client: transport.Client) handler.Handler {
+fn bareHandler(up: *upstream_owner.Owner) handler.Handler {
     return .{
-        .upstream = client,
-        .blocking = blocking,
-        .forward_read_timeout = forward_timeout,
+        .upstream = up,
+        .policy = .{ .blocking = blocking, .forward_read_timeout = forward_timeout },
     };
 }
 
@@ -112,7 +112,8 @@ test "a udp query is answered on the loopback" {
     const io = threaded.io();
 
     var fake: FakeUpstream = .{ .reply = response_bytes };
-    var h = bareHandler(fake.client());
+    var h_owner: upstream_owner.Borrowed = .{};
+    var h = bareHandler(h_owner.client(fake.client()));
 
     const listen_address: net.IpAddress = try .parse("127.0.0.1", 0);
     var server = try udp_server.UdpServer.bind(gpa, io, listen_address, &h, .{ .max_in_flight = 4 });
@@ -150,7 +151,8 @@ test "a runt datagram is dropped and no reply is sent" {
     const io = threaded.io();
 
     var fake: FakeUpstream = .{ .reply = response_bytes };
-    var h = bareHandler(fake.client());
+    var h_owner: upstream_owner.Borrowed = .{};
+    var h = bareHandler(h_owner.client(fake.client()));
 
     const listen_address: net.IpAddress = try .parse("127.0.0.1", 0);
     var server = try udp_server.UdpServer.bind(gpa, io, listen_address, &h, .{ .max_in_flight = 4 });
@@ -185,7 +187,8 @@ test "an oversize datagram arrives truncated and is dropped" {
     const io = threaded.io();
 
     var fake: FakeUpstream = .{ .reply = response_bytes };
-    var h = bareHandler(fake.client());
+    var h_owner: upstream_owner.Borrowed = .{};
+    var h = bareHandler(h_owner.client(fake.client()));
 
     const listen_address: net.IpAddress = try .parse("127.0.0.1", 0);
     var server = try udp_server.UdpServer.bind(gpa, io, listen_address, &h, .{ .max_in_flight = 4 });
@@ -226,7 +229,8 @@ test "deinit ends a serve loop that is blocked on receive" {
     const io = threaded.io();
 
     var fake: FakeUpstream = .{ .reply = response_bytes };
-    var h = bareHandler(fake.client());
+    var h_owner: upstream_owner.Borrowed = .{};
+    var h = bareHandler(h_owner.client(fake.client()));
 
     const listen_address: net.IpAddress = try .parse("127.0.0.1", 0);
     var server = try udp_server.UdpServer.bind(gpa, io, listen_address, &h, .{ .max_in_flight = 4 });