function reload_certificates

Re-read the configured TLS certificate and key files

Applies to every listener that terminates TLS with them: HTTP/1.1 + WebSocket, HTTP/3, and the QUIC RPC listener. Connections already established keep the certificate they handshook with; new handshakes use the reloaded one.

A subsystem whose files fail to load keeps its previous certificate rather than dropping to none, so a half-written renewal cannot take the server down.

Safe to call from any thread while the server is running. It reads files and allocates, so call it from a normal thread (e.g. an asio signal_set handler), never from a raw POSIX signal handler.