Auth config regeneration in dev can reuse a cached config #550

Problem

loadVoidAuthConfig() uses a plain native import() of the config file URL. Loading the same path again in the same Node process can therefore return the original module after the file has been edited.

The dev watcher explicitly handles changes to auth-config files and calls writeAuthDatabaseFiles(), which loads the config through this function. Consequently, that regeneration can use stale settings even though it was triggered by a config edit.

Documentation and intended behavior

The auth guide documents auth.ts customization and automatic auth-table creation during local development, but does not explicitly promise that auth-config edits hot-reload.

This issue is based on the existing implementation: the watcher already responds to those edits and attempts regeneration, which suggests it intends to use the updated config. This is an inference about intended behavior, not a claim that the docs guarantee hot reload. If a restart is intentionally required, that requirement should be made explicit.

Confirmed reproduction

A direct reproduction using the production loadVoidAuthConfig() function:

1. Write a temporary module exporting { marker: 'auth-before' }.
2. Load it with loadVoidAuthConfig(path).
3. Overwrite the same file with { marker: 'auth-after' }.
4. Call loadVoidAuthConfig(path) again in the same process.

Both calls returned { marker: 'auth-before' }, and the returned objects were identical, although the file contained auth-after.

The loader caching was reproduced directly. A complete auth application with a schema-changing edit has not been tested end to end; the consequence for generated auth files follows from inspection of the watcher and generation path.

Expected behavior and scope

When regeneration runs in response to an auth-config edit, it should evaluate the current configuration. Restarting the dev process is the current workaround.

This behavior already exists on main and is independent of the incremental source-analysis changes in #543.

A fix should preserve existing module compatibility and cover direct config edits, edits to imported local helpers, and recovery after correcting a syntax error. Reloading only the top-level file may leave its imported dependencies cached.

Relevant code: auth config loader, routing watcher and auth-file generation.