Function ensure_server_materials 

pub fn ensure_server_materials(
    dir: &Path,
    server_sans: &[String],
) -> Result<ServerMaterials>

Ensure mTLS server materials exist under dir.

The per-daemon CA is the root of trust and is never silently rotated: if ca.crt and ca.key are present they are loaded and reused, and only a missing server leaf is regenerated. A fresh CA is generated only when the CA key is genuinely absent. This survives partial on-disk state (e.g. a deleted or corrupt server.crt) without invalidating already-issued client certificates. Private keys are written 0600 and the directory 0700 on Unix. server_sans overrides the default SAN set when non-empty.