dot upstreams: per-upstream tls_name for sni and cert verification by dns name

specs/milestone-3.md

@@ -1011,3 +1011,13 @@ review rounds; findings went 9 → 3 → 0):
   `OutOfMemory` is a local resource, not a peer fault.
 - `transport.zig`: `Endpoint.parse` rejects userinfo/query/fragment delimiters
   (`@`, `?`, `#`) in the authority, and `?`/`#` in a DoH path.
+- `dot_client.zig` (follow-up, tls_name commit): `DotClient.init` takes a
+  `tls_name`; it is the SNI and certificate-verification name, while the dial
+  target stays `endpoint.host`. Empty keeps the endpoint host, which is the
+  behavior described above. The same follow-up fixed a send bug this file
+  had from the start, invisible until a DoT handshake first succeeded:
+  `tls.Client.flush` only encrypts into the socket writer's buffer and never
+  flushes it, so the query never left the process and the peer eventually
+  closed the connection (`ReceiveFailed`/`EndOfStream`). `TlsStream.flush` now
+  does both flushes and `exchange` calls it; a hermetic loopback test in
+  `tls_client_integration_test.zig` covers it.

specs/milestone-4.md

@@ -1920,3 +1920,18 @@ refinements (three review rounds; findings went 8 → 3 → 1 low):
   stock 0.16 — the `-Dlive` DoT case fails with `CertificateHostMismatch`
   against 1.1.1.1 while live DoH passes. Planned follow-up (own commit): a
   per-upstream `tls_name` for SNI + verification while dialing the IP.
+
+### Follow-up: per-upstream `tls_name`
+
+The stdlib limitation above is now worked around the way stubby and unbound
+do it. `UpstreamServer` (not the `upstream` timeout section) gains
+`tls_name: []const u8 = ""`, migration step 2 adds
+`upstreams.tls_name TEXT NOT NULL DEFAULT ''`, and the ZON round trip carries
+it like every other field. `validate.zig` adds `BadTlsName` (must pass
+`dns.name.fromText`) and `TlsNameOnNonTlsUpstream` (a `tls_name` on a DoH
+upstream is a config error, because DoH verifies by its url host and would
+ignore the field). `DotClient` uses it for SNI and verification while still
+dialing `endpoint.host`, and `cli.zig`'s check probe passes it through. The
+`-Dlive` DoT test now uses `1.1.1.1` with `one.one.one.one` and passes; making
+it pass also uncovered and fixed a missing socket flush in the DoT send path
+(see the milestone-3 note).