storage and config: sqlite wrapper, migrations, querylog policy, repositories, zon config with import/export/check cli

specs/research/zig-0.16-api-notes.md

@@ -184,3 +184,14 @@ changed most of these APIs.
 - TLS 1.2/1.3. **No ALPN, no session resumption** (fine for DoT; DoH over HTTP/1.1 works
   without ALPN in practice — verify against real upstreams in Phase 3).
 - CA roots: `std.crypto.Certificate.Bundle` (note the path), `bundle.rescan(gpa, io, now)`.
+
+## Certificate verification ignores IP SANs (verified 0.16.0)
+
+`std.crypto.Certificate.Parsed.verifyHostName` (Certificate.zig:313) checks only
+`dNSName` general names in the SAN extension; the switch's `else => {}` skips
+`iPAddress` (tag 7) entries entirely. Consequence: a TLS connection whose
+verification name is an IP literal (DoT `tls://1.1.1.1:853`) always fails with
+`error.CertificateHostMismatch` against certificates that carry the address only
+as an iPAddress SAN — which is how Cloudflare and Quad9 issue theirs. A DoT
+upstream therefore needs a DNS `tls_name` for SNI + verification while dialing
+the IP; verifying by bare IP cannot work on stock 0.16.