dot upstreams: per-upstream tls_name for sni and cert verification by dns name

specs/milestone-3.md

@@ -1011,3 +1011,13 @@ review rounds; findings went 9 → 3 → 0):
   `OutOfMemory` is a local resource, not a peer fault.
 - `transport.zig`: `Endpoint.parse` rejects userinfo/query/fragment delimiters
   (`@`, `?`, `#`) in the authority, and `?`/`#` in a DoH path.
+- `dot_client.zig` (follow-up, tls_name commit): `DotClient.init` takes a
+  `tls_name`; it is the SNI and certificate-verification name, while the dial
+  target stays `endpoint.host`. Empty keeps the endpoint host, which is the
+  behavior described above. The same follow-up fixed a send bug this file
+  had from the start, invisible until a DoT handshake first succeeded:
+  `tls.Client.flush` only encrypts into the socket writer's buffer and never
+  flushes it, so the query never left the process and the peer eventually
+  closed the connection (`ReceiveFailed`/`EndOfStream`). `TlsStream.flush` now
+  does both flushes and `exchange` calls it; a hermetic loopback test in
+  `tls_client_integration_test.zig` covers it.