dot upstreams: per-upstream tls_name for sni and cert verification by dns name

src/config/import.zig

@@ -388,7 +388,7 @@ const full_source: [:0]const u8 =
     \\    .groups = .{ .{ .name = "default" }, .{ .name = "kids", .safe_search = true } },
     \\    .upstreams = .{
     \\        .{ .url = "https://dns.example/dns-query", .priority = 10 },
-    \\        .{ .url = "tls://dot.example:853", .priority = 20, .enabled = false },
+    \\        .{ .url = "tls://dot.example:853", .priority = 20, .enabled = false, .tls_name = "dot.example" },
     \\    },
     \\    .clients = .{ .{ .ip = "FD00:0:0:0:0:0:0:1", .name = "tablet", .group = "kids" } },
     \\    .client_prefixes = .{ .{ .prefix = "192.168.1.0/24", .group = "kids", .priority = 50 } },
@@ -449,6 +449,14 @@ test "importSource seeds a migrated database and group 'default' keeps id 1" {
     try testing.expectEqual(@as(i64, 2), try database.queryInt("SELECT count(*) FROM upstreams"));
     // The v6 client address was written in canonical form, not as typed.
     try testing.expectEqual(@as(i64, 1), try database.queryInt("SELECT count(*) FROM clients WHERE ip = 'fd00::1'"));
+    try testing.expectEqual(
+        @as(i64, 1),
+        try database.queryInt("SELECT count(*) FROM upstreams WHERE tls_name = 'dot.example'"),
+    );
+    try testing.expectEqual(
+        @as(i64, 1),
+        try database.queryInt("SELECT count(*) FROM upstreams WHERE tls_name = ''"),
+    );
 }
 
 test "applyToDb without force refuses a configured database and changes nothing" {