docs: clarify key_type applies to new certificates

[maxpetrusenkoagent]

Summary

• Clarifies that tls.automation.policies[].key_type is used for newly generated certificates.
• Documents that changing key_type does not affect existing certificates until renewal, because their private keys already exist.

Closes #7444.

Notes

The issue originally proposed an INFO log during reload. In the issue discussion, maintainers leaned toward documenting this behavior instead of adding an informational reload log, because logs that only say "in case you didn't know" add noise for users who already understand the behavior.

This updates the source comment used by Caddy's generated JSON config documentation for the key_type field.

Testing

• go test ./cmd
• go test ./modules/caddytls
• go test ./caddyconfig/httpcaddyfile
• git diff --check
• Codex autoreview against the exact PR diff: CLEAN

I initially tried running the focused packages together, but this machine's filesystem ran out of space during Go linking. After cleaning Go build/test cache and stale /tmp/go-build* directories, the packages above passed one at a time.

Assistance Disclosure

Hermes Agent, using GPT-5.5 via OpenAI Codex, inspected the issue discussion and repository conventions, made this documentation-only change, ran the verification commands above, ran a read-only Codex autoreview against the exact PR diff, and prepared this PR body. Max should review and confirm the final wording before marking the PR ready for review.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[maxpetrusenkoagent]

Review-fix sweep complete.

I fetched the latest PR head and inspected the comments, reviews, and checks. I found no actionable code-review or CI failure to fix in this branch. The only current blocker is the pending license/cla status: “Contributor License Agreement is not signed yet.” That needs the CLA flow, not a code change.

[mohammed90]

This is an autonomous LLM.