fix(gateway): reject mismatched certificate keys - #917

Problem

Gateway loaded a certificate and private key without checking that their public keys matched. Reload appeared accepted, but the TLS listener then failed to use the identity.

Root cause and fix

Compare the public keys before publication and reject mismatched certificate/key material.

Implementation

The branch records the following focused implementation work:

• fix(gateway): reject mismatched certificate keys
• test(gateway): retain cert on mismatched hot reload

Changed paths:

• dstack/gateway/src/cert_store.rs

Scope

This PR addresses one logical gateway finding. It intentionally excludes the acceptance-test infrastructure from #841 and unrelated product fixes from #840.

Dependency and merge order

This PR is based directly on master and does not require another split product PR to merge first.

Verification

• git diff --check origin/master..origin/codex/fix-gateway-cert-key-match: passed.
• The declared base was verified as an ancestor of the PR head.
• Focused compile/check verification was run for the changed component where applicable; non-Rust packaging or configuration changes were reviewed against their exact branch delta.