feat(tunnel): add configuration hot reload support

[lexfrei]

Summary

Add support for hot reloading configuration without restarting cloudflared. This enables updating ingress rules, warp-routing settings, and origin request configuration on the fly.

Related issues: #240, #301, #512, #965

Changes

• Add LocalConfigWatcher component that monitors config.yaml for changes via fsnotify
• Add SIGHUP signal handling to trigger manual configuration reload
• Reuse existing Orchestrator.UpdateConfig() mechanism (already used for remote-managed tunnels)
• Include 500ms debounce to handle rapid file changes from editors

Usage

# Automatic: edit config.yaml while cloudflared is running
# Changes are detected and applied within ~500ms

# Manual: send SIGHUP signal
kill -HUP $(pgrep cloudflared)

What can be hot-reloaded

Parameter	Hot Reload
ingress rules	✅
warp-routing	✅
originRequest	✅
tunnel UUID	❌
credentials-file	❌
protocol	❌

Limitations

• Only works for locally managed tunnels (not token-based)
• Invalid configuration is rejected and previous config is preserved
• Immutable parameters (tunnel UUID, credentials) require restart

Test plan

• Unit tests for config conversion (TestConvertLocalConfigToJSON*)
• Unit tests for validation (TestValidateLocalConfig*)
• Unit tests for file watcher (TestLocalConfigWatcher*)
• Unit tests for SIGHUP handling (TestSignalShutdown)
• Manual testing with local tunnel