feat: runtime credential rotation for AMQP, Redis, and TLS

[markusnissl]

Summary

• config.SecretWatcher — watches _FILE env var paths via fsnotify, updates Watchable[string] on content change (Kubernetes symlink-swap pattern)
• AMQP UpdateURL / UpdateTLS — stores new credentials and triggers reconnect; dial() reads under RLock for thread safety
• Redis SwapClient — creates new client, validates via ping, atomically swaps, closes old client; fires onReconnect for subscriber refresh
• TLSReloader — watches cert/key/CA files, provides dynamic GetCertificate/GetClientCertificate callbacks; debounced reload
• WithSecretRotation() on Builder — single toggle that enables file watchers for all configured infrastructure
• Database — documented why runtime rotation is infeasible (database/sql pool); recommends Kubernetes rolling restart

How It Works

K8s secret update → mounted file changes (symlink swap)
                   → fsnotify detects change
                   → SecretWatcher reads new content
                   → Watchable.OnChange fires
                   → Component.UpdateURL / SwapClient / TLSReloader.reload
                   → New connections use new credentials

Usage

app.New("my-service", version, cfg.BaseConfig).
    WithRabbitMQ(cfg.AMQPURL).
    WithRedis(&redis.Options{Addr: cfg.RedisAddr}).
    WithSecretRotation().  // ← enables all watchers
    Router(func(infra app.Infrastructure) http.Handler { ... }).
    Run()

What Rotates vs What Doesn't

Component	Rotation	Mechanism
AMQP URL/password	Live	UpdateURL → reconnect loop
AMQP TLS certs	Live	UpdateTLS → reconnect loop
Redis password	Live	SwapClient → new client + ping validation
TLS certs (HTTP, mTLS)	Live	TLSReloader → GetCertificate callbacks
Database password	Restart	database/sql pool can't swap credentials

Test plan

• SecretWatcher: file change detection, atomic file replace, bad file keeps old value, no-op when no _FILE set
• TLSReloader: initial load, cert rotation detection, bad cert keeps old
• AMQP: UpdateURL builds/tests pass, dial() reads under lock
• Redis: SwapClient builds/tests pass, Client() reads under lock
• App: builds with WithSecretRotation wiring
• Integration: end-to-end rotation with real AMQP/Redis (requires Docker)