db-mode config changes apply live in-process

settings and upstream writes now follow a prepare, commit, publish, retire
contract: candidates are built and validated before the database transaction,
published as infallible pointer swaps, and old generations retire after their
readers drain. per-query policy values snapshot once per query; upstream pool,
cache, rate limiter, sessions, api limiter, log sink, blocklist scheduler and
the query-log queue each gained one named live operation. restart_required
shrinks from every scalar key to the bind keys and web.enabled; the admin ui
drops its restart notices for everything else. file mode is unchanged.

src/storage/phase6_integration_test.zig

@@ -406,7 +406,8 @@ test "S8 case 5: a retention pass prunes the old rows and truncates the write-ah
     try testing.expectEqual(@as(i64, 4), try queries_repo.countRows(log_db.database()));
     try testing.expect(try f.sizeOf("querylog.db-wal") > 0);
 
-    var pass: retention.Retention = .init(.{ .retention_days = 30 });
+    var pass_days: retention.RetentionDays = .init(30);
+    var pass: retention.Retention = .init(&pass_days);
     pass.runOnce(io, log_db.database(), null, null);
 
     try testing.expectEqual(@as(u64, 1), pass.snapshotStats().passes);
@@ -473,7 +474,7 @@ test "S8 case 6: a critical disk gates the flushes and recovery releases them" {
     try testing.expectEqual(@as(u64, 0), query_log.rows_written.load(.monotonic));
     try testing.expectEqual(@as(i64, 0), try queries_repo.countRows(log_db.database()));
 
-    monitor.cfg = .{ .min_free_mb = 0, .warn_free_mb = 0 };
+    monitor.setThresholds(.{ .min_free_mb = 0, .warn_free_mb = 0 });
     monitor.sample(io, null, 0);
     try testing.expectEqual(disk_monitor.State.ok, monitor.state());
     try testing.expect(monitor.writesAllowed());