#4620 Docs: swamp serve reload now applies most serve.yaml settings without --hot-reload or a restart

The manual's serve reload page is out of date since #4588 (swamp PR #3716) and #4602 (swamp PR #3728). The design docs in the swamp repo (design/primitives/serve.md, "PID file and reload"; design/enablers/access-control.md, "Admission") describe the current behaviour.

Pages

• content/manual/reference/swamp-serve/hot-reload.md (main changes)
• content/manual/reference/swamp-serve/serve-flags.md (rows that say a setting is fixed at startup)
• content/manual/reference/swamp-serve/authorization.md or wherever admission lists are covered: they now change on reload

What is stale on hot-reload.md

• "Both modes require the serve process to be running with --hot-reload." No longer true:
  • swamp serve reload --server works on every serve, and stays admin-only.
  • SIGHUP reloads a serve whose stdin is not a terminal (daemon, container, systemd's systemctl reload) or one started with --hot-reload.
  • A serve on a terminal without --hot-reload still stops on SIGHUP.
• "PID file: Written at startup when --hot-reload is active." Now written whenever SIGHUP reloads.
  • .swamp/serve.pid stays a bare PID.
  • .swamp/serve.pid.json beside it records the start time and executable.
  • A local swamp serve reload refuses a stale file that names another process, and warns and signals when it cannot tell.
• "Reload behavior" lists only extensions, the trust list, triggers and webhooks. Reload now also re-reads serve.yaml with startup's own checks and applies settings without a restart:
  • If the file is refused: nothing changes, and swamp serve reload --server exits 1 with configRejected: true.
  • Applied:
    • the dashboard and internal API;
    • the run, webhook-run and signal-wait limits;
    • the queue, idle, drain and listener-grace timeouts;
    • auto-resume, triggers, webhooks and the routes directory;
    • trust-proxy, trusted-hosts, dispatch-env-allow and verify-on-enroll;
    • the intervals of services already running;
    • in audit: the policy, alerts, fail-open and sinks;
    • the access lists (below).
  • Needs a restart: admins, stale-ttl, heartbeat-interval, remote-only, the listener, TLS and the CA cert, the OAuth client, the datastore, and the audit stores, WAL, HMAC and batching. Turning a timed service on or off, scheduling, grant mode and grant sources also need one; swamp-club#4604 will change the last three.
• The reload report: the JSON settings block lists applied, needsRestart (with reasons) and overridden (pinned by a startup flag or environment variable). Each reload writes a serve.config.reloaded audit event.

Access lists (OAuth)

• Removing a name from allowed-users takes effect on reload.
• A new name is admitted once it resolves, from the stored name map or through the club API key (SWAMP_API_KEY). Until then it waits, is reported, and is retried on each reload.
• A name the provider does not know is skipped for good, as at startup.
• A list that removals leave empty, with no collectives, admits no one, admins included, until it is fixed.
• Changing --admins needs a restart.

Suggested content

A "What reload changes" table (setting, applied or restart, notes), an example of the settings block from swamp serve reload --server --json, and the SIGHUP rule.