feat: reload declarative config without process restart

[shashankrawlani]

What

Adds a file-system watcher that re-applies a valid FREEAPI_CONFIG_PATH JSON
atomically, without stopping or restarting the FreeLLMAPI process. The last
known-good configuration is kept when a replacement is invalid or temporarily
unavailable.

Providers and deployment controllers (Infisical, Vault, AWS Secrets Manager,
Kubernetes Secrets, GitOps reconcilers) only need to write a temporary file and
mv it over the configured path — they are not coupled to FreeLLMAPI.

Why

Previously the config was loaded once at startup and never updated without a
restart. Operators using secret managers for provider keys had no safe way to
rotate them without downtime or manual steps.

How

• server/src/services/declarative-config-reloader.ts: generic, provider-agnostic
  file watcher. Handles overlapping reloads (debounce + queue), invalid JSON, and
  missing files gracefully.
• server/src/index.ts: activates the watcher when FREEAPI_CONFIG_PATH is set,
  falls back to the one-shot behaviour otherwise.
• Docs: both README.md and docker/README.md now document the watcher.
• Tests: declarative-config-reloader.test.ts covers atomic replacement and
  error-resilience.

Tests

Full suite: 1,045 / 1,045 passing (103 test files).

npm run test -w server

Checklist

• Includes a test
• Existing suite stays green
• No paid / card-gated dependencies added
• Scoped to one change