start_telemt() was a no-op when the service was already active, so
regenerating /etc/telemt/config.toml (e.g. reinstalling with a different
mask domain or switching lite<->pro) left the daemon running with the
OLD in-memory config. This caused the reported "lite-mode key does not
work" issue: after a fresh lite install over an existing pro install,
telemt kept tls_domain=anten-ka.com and dropped SNI=google.com clients
with unknown_sni_action=Drop even though /etc/telemt/config.toml said
tls_domain=google.com.
Fix: start_telemt now uses systemctl restart when the service is
already active, guaranteeing the fresh config is loaded.
