Add HTTPS identity rotation support

src/web_server.h

@@ -62,6 +62,14 @@ esp_err_t web_server_restart_current(uint32_t expected_generation);
  * Admission cannot be cancelled; normally does not return. Same caller rules. */
 esp_err_t web_server_reboot_current(uint32_t expected_generation);
 
+/* Combined identity/service owner operation, off HTTPD only. Nonzero expected
+ * generations select healthy running conditional rotation; both zero select CLI.
+ * reset is CLI-only and starts a stopped service; ordinary rotation leaves it stopped.
+ * committed reports irreversible NVS publication even when stop/start later fails.
+ * Reservation covers generation checks, crypto/commit and canonical stop/start. */
+esp_err_t web_server_replace_identity(uint32_t expected_service_generation,
+    uint32_t expected_identity_generation, bool reset, bool *committed);
+
 /* Start one TLS-only server on all active network interfaces.
  * Start/stop may wait for HTTPD; never call from its task or queued callbacks. */
 esp_err_t web_server_start(void);