db-mode config changes apply live in-process

settings and upstream writes now follow a prepare, commit, publish, retire
contract: candidates are built and validated before the database transaction,
published as infallible pointer swaps, and old generations retire after their
readers drain. per-query policy values snapshot once per query; upstream pool,
cache, rate limiter, sessions, api limiter, log sink, blocklist scheduler and
the query-log queue each gained one named live operation. restart_required
shrinks from every scalar key to the bind keys and web.enabled; the admin ui
drops its restart notices for everything else. file mode is unchanged.

src/storage/querylog_schema.zig

@@ -199,6 +199,29 @@ pub fn open(io: std.Io, dir: std.Io.Dir, path: [:0]const u8) Error!OpenResult {
     return result;
 }
 
+/// An additional connection to a `querylog.db` that `open` has already
+/// established, with the pragmas every connection to the file needs.
+///
+/// The canonical opener for every background connection: the log writer, the
+/// retention pass and the web task each own one (`retention.zig`'s contract),
+/// and a logger generation opens one per writer for that writer's whole life
+/// (`logger_controller.zig`) — two writers must never share a handle.
+///
+/// `dir` and `path` follow `open`'s resolution rule, and `dir` participates in
+/// it the same way: the caller passes either an absolute path with `dir` open
+/// on its parent, or `std.Io.Dir.cwd()` with a cwd-relative path. Nothing here
+/// touches the directory itself — the file already exists by contract — so the
+/// handle is present to make the pairing explicit at every call site rather
+/// than to be dereferenced.
+pub fn reopen(io: std.Io, dir: std.Io.Dir, path: [:0]const u8) db.Error!db.Db {
+    _ = io;
+    _ = dir;
+    var database = try db.Db.open(path, .{ .mode = .read_write_existing });
+    errdefer database.close();
+    try db.applyPragmas(&database, .{});
+    return database;
+}
+
 /// The whitelist. `null` means "propagate, do not touch the file".
 fn recreatable(e: db.Error) ?RecreateReason {
     return switch (e) {