`sni-certs` folder auto-scan with reload modes

[raffaelschneider]

Parent: #115
Depends on: #116

Scope

Add a new sni-certs block for automatic folder scanning of cert/key pairs, with configurable reload modes.

Tasks

• New sni-certs block with cert-folder, reload-mode, reload-interval
• reload-mode options: off, interval, watch (platform-native with interval fallback)
• Full rescan + diff + atomic swap on reload
• Skip + warn for malformed/unpaired certs in folder scans
• Metrics: zentinel_tls_certificates_loaded, zentinel_tls_reload_total, etc.
• allow-sni-overlaps flag (default false), deterministic tie-breaking when enabled
• Update config validation and docs

Example

sni-certs {
    cert-folder "/etc/zentinel/certs/dynamic/"
    reload-mode "watch"
    reload-interval "30s"
}

Context

See discussion in #115 for full design rationale. Builds on #116 (CN/SAN extraction).

[raffaelschneider]

Progress Update

Several foundational pieces for this issue have been completed:

Done:

• CN/SAN extraction from certificates — PR feat(tls): make hostnames optional in sni-cert with CN/SAN auto-extraction #118, PR feat(tls): optional SNI hostnames with CN/SAN auto-extraction and priority tie-breaking #138
• Optional hostnames in sni-cert blocks (auto-extraction fallback) — PR feat(tls): optional SNI hostnames with CN/SAN auto-extraction and priority tie-breaking #138
• priority-hostnames for deterministic tie-breaking — PR feat(tls): optional SNI hostnames with CN/SAN auto-extraction and priority tie-breaking #138
• Dependency Make hostnames optional in sni-cert with CN/SAN auto-extraction #116 is closed

Remaining:

• New sni-certs block with cert-folder, reload-mode, reload-interval
• reload-mode options: off, interval, watch (platform-native with interval fallback)
• Full rescan + diff + atomic swap on reload
• Skip + warn for malformed/unpaired certs in folder scans
• Metrics: zentinel_tls_certificates_loaded, zentinel_tls_reload_total, etc.
• allow-sni-overlaps flag (default false), deterministic tie-breaking when enabled
• Update config validation and docs

The core remaining work is the sni-certs folder auto-scan with reload modes — the cert parsing and SNI resolution infrastructure it builds on is already in place.