fix: validate host certificates before selecting IPs

[xuyua9]

Summary

• Validate each DNS candidate over HTTPS with the requested hostname as SNI.
• Reject connection or certificate failures before latency-based IP selection.

Context

Issue: #310

The issue reports an incorrect IP serving a certificate for another hostname. The current updater selects the fastest TCP-connected address without checking the certificate hostname.

This PR is intentionally limited to TLS/SNI candidate validation. It does not duplicate the invalid-payload publication guard in open PR #315.

Validation

• Offline mock regression covers valid TLS, certificate mismatch, and connection failure.
• Python syntax compilation.
• git diff --check