Hot-reload content on a NATS trigger instead of requiring a restart

questions is now Arc<ArcSwap<HashMap<...>>> - readers do a lock-free
atomic load (state.questions.load().get(&id).cloned()), never blocking
on or blocked by a reload. content::watch_for_reload subscribes to
portal.content.reload (published by the questions repo's own CI after
it lints a push - see that repo's lint-and-reload.yml) and swaps in a
freshly re-fetched HashMap on each message. A fetch/parse failure logs
and keeps serving the last-good content rather than clearing it.

src/app.rs

@@ -742,7 +742,7 @@ fn NotFound() -> impl IntoView {
 pub async fn get_question(path: String) -> Result<Option<Question>, ServerFnError> {
     use crate::server::AppState;
     let state = expect_context::<AppState>();
-    Ok(state.questions.get(&path).cloned())
+    Ok(state.questions.load().get(&path).cloned())
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -768,7 +768,9 @@ pub async fn submit_answer(
     let state = expect_context::<AppState>();
     let question = state
         .questions
+        .load()
         .get(&question_id)
+        .cloned()
         .ok_or_else(|| ServerFnError::new("unknown question"))?;
 
     let session: tower_sessions::Session = leptos_axum::extract().await?;
@@ -776,7 +778,7 @@ pub async fn submit_answer(
         .get::<User>(SESSION_USER_KEY)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
-    if !is_qualified(user.as_ref(), question) {
+    if !is_qualified(user.as_ref(), &question) {
         return Err(ServerFnError::new("not authorized for this question"));
     }