[Bug] The web allowlist is read once at startup, so a target added later is refused

[traviswu-bigstack]

Description

/etc/cube-advisor-agent/web-targets.json is the node's veto over what the
Advisor may dial, and it changes underneath a running agent by design —
advisor target_set writes it, and config_advisor's Commit seeds one on a
node that had none. The agent read it once, so every such change needed a
restart, and the failure pointed away from the cause: a channel refused naming a
target the file plainly contained.

Three times on the 1cc r630 — cube-cos-idp, then cube-cos-skyline and
cube-cos-ceph. Each looked like a proxy defect until the file was read beside
the agent's own startup line (serving … 3 web targets against four in the file).

How to Reproduce

1. hex_cli -c advisor -c target_set -c cube-cos-idp -c <vip>:10443
2. cat /etc/cube-advisor-agent/web-targets.json — the entry is there.
3. Open that target from the Advisor.
4. journalctl -u cube-advisor-agent:
   web channel for "cube-cos-idp" ended: console: target is not in this node's web allowlist: "cube-cos-idp"

Expected behavior

A target added with advisor target_set is dialable without restarting the agent.

QA Verification

#	Command / steps	Expected outcome
1	advisor target_set <name> <host:port> on a running agent, then open that target	the channel connects, no restart
2	corrupt the file, open any target	refused; the agent does not serve from a stale copy
3	start the agent with a malformed file	refuses at startup naming the file
4	go test ./internal/console/	passes

Fixed by #44.

Output artifacts (Definition of Done)

• Handbook knowledge update — landed as
  kb/cube-ai-advisor/known-issues/config-only-changes-never-reach-the-process.md
  via bigstack-oss/bigstack-handbook#679.
• QA Status declared at Done — set on the board.