test: more deny-path tests for the config reload #176

Why

The security review of #175 (reload without a restart, #29) asked for three more tests. The code paths are guarded by the same checks as the tested secret paths, but each deny path should have its own test (AGENTS.md).

Done when

• A test in cmd/nodkey: a reload where the server takes the new pins and then the service refuses the config (loadNew). The old pins come back: the new client's pin is refused, and the old client still works.
• A test: an SSH login that waits for a tap while a reload removes its host from the key's hosts. After the tap, the login is denied (403, denied with cause not_allowed), and nothing is signed.
• TestStillAllowed in internal/broker covers the key path: another public key in the key file (sameKey), and a host that the new config does not allow.

Related: #29, #175.