dot upstreams: per-upstream tls_name for sni and cert verification by dns name

src/config/model.zig

@@ -204,7 +204,16 @@ pub const BlocklistUpdate = struct { enabled: bool = true, interval_hours: u16 =
 
 pub const Group = struct { name: []const u8, safe_search: bool = false };
 
-pub const UpstreamServer = struct { url: []const u8, priority: i32 = 100, enabled: bool = true };
+pub const UpstreamServer = struct {
+    url: []const u8,
+    priority: i32 = 100,
+    enabled: bool = true,
+    /// DoT only. The DNS name used for SNI and certificate verification while
+    /// the connection still dials the URL's host. `std.crypto.Certificate`
+    /// matches dNSName SANs only, so a `tls://` upstream written as an IP
+    /// literal cannot verify without one. Empty means "verify by the URL host".
+    tls_name: []const u8 = "",
+};
 
 pub const Client = struct { ip: []const u8, name: []const u8 = "", group: []const u8 = "default" };