dot upstreams: per-upstream tls_name for sni and cert verification by dns name

specs/milestone-4.md

@@ -1920,3 +1920,18 @@ refinements (three review rounds; findings went 8 → 3 → 1 low):
   stock 0.16 — the `-Dlive` DoT case fails with `CertificateHostMismatch`
   against 1.1.1.1 while live DoH passes. Planned follow-up (own commit): a
   per-upstream `tls_name` for SNI + verification while dialing the IP.
+
+### Follow-up: per-upstream `tls_name`
+
+The stdlib limitation above is now worked around the way stubby and unbound
+do it. `UpstreamServer` (not the `upstream` timeout section) gains
+`tls_name: []const u8 = ""`, migration step 2 adds
+`upstreams.tls_name TEXT NOT NULL DEFAULT ''`, and the ZON round trip carries
+it like every other field. `validate.zig` adds `BadTlsName` (must pass
+`dns.name.fromText`) and `TlsNameOnNonTlsUpstream` (a `tls_name` on a DoH
+upstream is a config error, because DoH verifies by its url host and would
+ignore the field). `DotClient` uses it for SNI and verification while still
+dialing `endpoint.host`, and `cli.zig`'s check probe passes it through. The
+`-Dlive` DoT test now uses `1.1.1.1` with `one.one.one.one` and passes; making
+it pass also uncovered and fixed a missing socket flush in the DoT send path
+(see the milestone-3 note).