v1.6.1 — host certificate rotation no longer locks a cluster out of itself

Schema v50, unchanged from v1.6.0. No migration.

Fixes

• A reissued host certificate left the serial recorded in its host row
  stale, and peer trust binds a live row to that serial. Nothing wrote the
  column on rotation, so every daemon refused every peer ("replication RPC
  requires peer mTLS") and replication stopped cluster-wide, with the
  split-brain detector blind for the same reason while workloads kept
  running. A node now re-records its own serial at startup from the
  certificate installed on its own disk, so a rotation converges by
  ordinary replication.
• An unreadable certificate never overwrites a good recorded serial: a
  local file-permission problem must not become a cluster-wide trust
  downgrade.

Added

• auth.trust_rotated_peer_certs (default false) — the recovery switch for
  a cluster ALREADY locked out by stale recorded serials, where the
  correction cannot replicate because replication is what is refused. Set
  it on every node, let the re-recorded serials replicate, then set it
  back to false. It relaxes the serial comparison only: a removed host
  stays removed, and a distributable client certificate still cannot act
  as a peer. Revocation is unaffected — the CRL is verified at the TLS
  handshake.

Upgrading

• Schema-neutral, so this rolls like any ordinary binary upgrade. Running
  domains survive the daemon re-exec. Clusters whose recorded serials are
  already stale need the recovery switch on for one roll, then off.