What

Adds a single canonical, ops-facing reference for config hot-reload behaviour, fixing the "semantics scattered across config_reload.rs / CLAUDE.md / two arch docs" problem.

New doc — docs/operations/config-reload.md

• One row per KernelConfig field with its reload classification (RequiresRestart / HotReload / Ignore-noop) and a one-line meaning, grouped by config section.
• Intro explaining POST /api/config/reload semantics (the three-bucket plan from build_reload_plan), the per-agent-cap-needs-respawn gotcha (from CLAUDE.md), and the conditional log_level reloader caveat.

How the table was derived

Every row is transcribed from build_reload_plan / build_reload_plan_with_caps in crates/librefang-kernel/src/config_reload.rs — the hand-tuned branches at the top plus the #5619 backfilled RESTART/NOOP blocks. The field set is the literal mirror of classified_reload_fields(). One-line meanings are taken from the KernelConfig field doc-comments in librefang-types/src/config/types.rs, not invented.

external_auth row reflects main's post-#5652 classification

external_auth is documented as R/H, matching what build_reload_plan actually does after #5652 restored main:

• IdP-identity changes (enabled, issuer_url, per-provider id/issuer_url/jwks_uri — see external_auth_idp_changed) are HotReload: they emit ReloadExternalAuth to flush the OIDC discovery + JWKS caches, no restart.
• Non-IdP sub-fields (session_ttl_secs, allowed_domains, redirect_url, scopes, audience, require_email_verified) are RequiresRestart: no hot reapply path is wired beyond the bare ArcSwap swap, so the planner conservatively flags a restart.

Cross-references (minimal pointer lines only)

• CLAUDE.md — new bullet in the config/hot-reload area pointing at the canonical doc.
• docs/architecture/message-history-trimming.md — note that max_history_messages is read live (no restart) + link.
• docs/architecture/trigger-dispatch-concurrency.md — new "Reload behaviour" note (queue caps hot-reload; per-agent cap needs respawn) + link.

Drift guard

doc_reload_table_matches_classified_reload_fields (new test in config_reload.rs) parses the doc's field column and asserts it equals classified_reload_fields() in both directions. Combined with the existing every_config_field_is_reload_classified test, a new KernelConfig field now fails the build unless it is wired into the planner AND listed in the doc.

Scope note: dedup vs #5646 / #5652

An earlier revision of this PR also removed the external_auth restart branch in build_reload_plan. That code change is dropped here. The behaviour question — should non-IdP external_auth edits require a restart? — was settled by #5652 (merged), which keeps the conservative restart for non-IdP fields while hot-reloading IdP-identity changes. #5646, which proposed the broader "no restart for any external_auth field" behaviour, was closed as superseded. This PR now carries only additive docs + the drift test, and the doc/test reflect main's actual classification.

Verification

• cargo test -p librefang-kernel --lib config_reload — 42 passed, 0 failed (incl. the new doc_reload_table_matches_classified_reload_fields and the existing every_config_field_is_reload_classified; all external_auth_* tests green against main's classification).
• cargo check --workspace --lib --exclude librefang-desktop — clean.
• cargo clippy -p librefang-kernel --lib -- -D warnings — clean.
• cargo fmt -p librefang-kernel -- --check — clean.

Closes #5641