feat(zetesis,syntaxis,ergasia,horismos): live acquisition config + seed-threshold restart reclass (#529 step 7)

[forkwright]

Step 7 of the #529 reactive-config migration — the acquisition subsystems (indexer search, download queue, extraction) reconfigure live, and two structurally-frozen seed thresholds are reclassified as restart-required.

zetesis — SearchIndexerService holds Section<SearchSubsystemConfig> and takes one .get() snapshot per operation (max_concurrent_searches, search_timeout_seconds, max_response_body_bytes, per-op client timeout go live). New RateLimiter::reconfigure(requests, window) updates max_tokens/refill_rate and clamps tokens to the new ceiling, but leaves retry_after and last_refill untouched — so a reconfigure racing an active 429 embargo cannot un-embargo the indexer or resurrect burst tokens (the #533 embargo-freeze invariant survives). The cf-proxy, cardigann registry, and HTTP client are each behind a std::sync::RwLock<Arc<…>> read through a sync snapshot helper that clones the Arc and drops the guard before any await (never held across .await); an archon run_zetesis_supervisor swaps the proxy/registry on the relevant config change (a cardigann load failure keeps the old registry + error!).

syntaxis — DownloadQueue::update_config replaces the stored config (live retry_count/retry_backoff_base_seconds) and calls SlotAllocator::set_limits; next_dispatchable now reads allocator.max_per_tracker(), healing the frozen-vs-live max_per_tracker split-brain. A cap decrease below the in-flight count simply stops new dispatch until it drains — in-flight downloads are never cancelled; a cap increase runs a backlog pass so raised capacity fills immediately. run_syntaxis_supervisor drives it.

ergasia — SessionEngine holds Section<ErgasiaConfig> and builds ExtractionLimits per extract call, so max_extraction_depth/max_decompression_ratio are live.

horismos — ergasia.seed_ratio_threshold and ergasia.seed_time_threshold_hours are added to RESTART_REQUIRED (frozen into the librqbit SeedingPolicy at session build with no reconfigure API, so a reload would otherwise "apply" them with zero effect — a step-1 honesty-invariant violation). Held back + reported on reload.

Tests (real ConfigManager/Section where a live handle is needed): rate-limiter embargo/accrual survives reconfigure (4 tests), a lowered max_concurrent_searches bounds the next fan-out, a cf-proxy swap proxies a previously-unproxied service, SlotAllocator/update_config decrease stops dispatch without eviction and increase dispatches backlog, and the two seed thresholds are held back on reload.

Gate: kanon gate --full green — fmt, check, clippy (-D warnings), nextest 646 (5 crates) / full workspace, deny, kanon lint (0/0). Gate-Passed stamped.

Refs #529