docs: document certificate_reload setting in reference config (#7095)

Certificate hot-reload is disabled by default; document the setting
so operators know it exists and can opt in.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ycombinator

fleet-server.reference.yml

@@ -101,6 +101,11 @@ fleet:
 #        certificate: /creds/cert.pem
 #        key: /creds/key.pem
 #        key_passphrase_path: /creds/key.pem
+#        certificate_reload:
+#          enabled: false    # Disabled by default; set to true to enable periodic reload
+#          reload_interval: 5s  # How often to re-read cert/key files from disk.
+#                               # After rotation, new certs are picked up within
+#                               # this interval on the next TLS handshake.
 #
 #     # timeouts controls various api timeouts
 #     timeouts: