Reload guard.yaml without losing the bounties

systemctl reload guard, guard reload or SIGHUP reads the configuration
again: a watch keeps its bounties and counts under the same name and
takes its new settings at once; its source starts again only if it
changed; watches gone stop, new ones start; a file with a mistake is
refused. The Housecarl connection, state, socket and log wait for a
restart, and guard reload says so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/bounty/bounty.go

@@ -46,6 +46,13 @@ func (t *Tracker) Add(p netip.Prefix, at time.Time) (int, bool) {
 	return len(ts), false
 }
 
+// Set changes the hits and window (a reload); the bounties stay.
+func (t *Tracker) Set(hits int, within time.Duration) {
+	t.mu.Lock()
+	t.Hits, t.Within = hits, within
+	t.mu.Unlock()
+}
+
 // keep drops the times before from (times are in order).
 func keep(ts []time.Time, from time.Time) []time.Time {
 	i := 0