Add UpdateTlsConfig to LeafNodeManager with CurrentCertPath, CurrentKeyPath, IsTlsEnabled, and TlsReloadCount. Add LeafTlsReloadResult record. Add 10 unit tests in LeafTlsReloadTests covering change detection, no-op idempotency, path tracking, counter semantics, and result payload.