Function spawn_cert_watcher 

pub fn spawn_cert_watcher(
    tls: TlsConfig,
    http2_enabled: bool,
    shared: Arc<ArcSwap<ServerConfig>>,
    label: &'static str,
)

Watches the cert/key files and hot-reloads shared when they change.

Mirrors crate::hot_reload::watch_config: an OS thread runs a notify watcher on each unique parent directory of the cert/key paths (so Kubernetes’ atomic secret symlink swap is caught, not just direct writes), forwarding events to a debounced (500 ms) async loop. On each change the ServerConfig is rebuilt and atomically stored; a bad/partial cert during rotation is logged and the current config is kept (never crash or drop TLS mid-rotation). label names the listener in logs (e.g. "data-plane").