Function server_leaf_sans 

pub fn server_leaf_sans(dir: &Path) -> Result<Option<Vec<String>>>

The Subject Alternative Names carried by the current server leaf in dir (server.crt, as written by ensure_server_materials_protected), read from the certificate itself: DNS names verbatim, IP addresses in canonical text form - the same spelling callers pass as server_sans. Ok(None) when no leaf exists yet.

This lets a caller that cannot currently determine part of its desired SAN set (an unreachable identity source) keep the names the leaf already carries instead of regenerating it without them.