Signals & reloads

Zero-downtime config reload, and a graceful shutdown that finishes in-flight requests.

Signal	Behavior
`SIGHUP`	Re-read and validate the config file. On success, listeners keep running and new load-balancer schedules apply immediately. On failure, the running config is kept and the error is logged.
`SIGTERM` / `SIGINT`	Graceful shutdown: stop accepting, let in-flight requests finish (15 s cap), then exit 0.

zero-downtime reload

 # edit torana.toml, then:
kill -HUP $(pgrep torana)

Listeners themselves are bound once at startup: a reload updates routes, upstreams, and weights, but adding or removing a [[listener]] requires a restart. This includes rotating a static tls_cert/tls_key pair: SIGHUP re-reads the file paths but the already-bound listener keeps serving the certificate it loaded at startup, so a renewed cert only takes effect after a restart. (Automatic HTTPS via ACME is unaffected: it renews and swaps certificates internally without a restart.) With graceful draining, a rolling restart behind an orchestrator is zero-dropped-requests anyway.

Next: observability.