Fix Windows address allocation check and add custom SNI for tcp-tls

When running on Windows with Wintun, assigning an overlay IPv4 address
via netsh triggers Duplicate Address Detection (DAD). During this tentative
window, binding a UDP socket to the address returns WSAEADDRNOTAVAIL
(os error 10049), causing the agent to prematurely log a false-positive
PluginError ('allocated ... but the address is not on any interface').

Furthermore, Russian TSPU / DPI filters block unrecognized SNIs and
non-standard ALPNs on TCP port 443 with TCP RST injection (os error 10054).
The default 'tsunagi.local' SNI and 'tsunagi-tls/1' ALPN were trivially
fingerprinted.

Key improvements:
- In crates/tsunagi/src/overlay/tun.rs, enhance address_is_local on Windows
  to inspect active OS interfaces via netdev::get_interfaces() if UDP
  bind fails.
- In crates/tsunagi/src/agent/network.rs, introduce an asynchronous retry
  loop in publish_allocations on Windows (up to 1.5s in 150ms intervals)
  to gracefully allow DAD and IP helper updates to complete before
  reporting missing addresses.
- In crates/tsunagi-tcp-tls, add support for custom SNI domain via
  protocol options (-o sni=<domain>), defaulting to 'cloudflare.com'
  instead of 'tsunagi.local'.
- Switch TLS ALPN in tsunagi-tcp-tls from 'tsunagi-tls/1' to 'http/1.1'
  to camouflage handshake traffic as standard HTTPS web traffic.
- Update tests to verify custom and default SNI behavior.

Validation on Linux:
- cargo fmt --all -- --check passed.
- cargo clippy --locked --workspace --all-targets -- -D warnings passed.
- cargo test --locked --workspace --all-targets passed (348 tests passed).
- cargo build --release passed.

crates/tsunagi-tcp-tls/src/plugin.rs

@@ -26,6 +26,8 @@ pub const TCP_TLS_VERSION: u16 = 1;
 pub struct TcpTlsConfig {
     /// Requested port to bind.
     pub port: Option<u16>,
+    /// Custom SNI domain to disguise TLS connections.
+    pub sni: Option<String>,
 }
 
 impl TcpTlsConfig {
@@ -39,6 +41,12 @@ impl TcpTlsConfig {
         self.port = Some(port);
         self
     }
+
+    /// Sets the SNI domain used to disguise TLS connections.
+    pub fn with_sni(mut self, sni: impl Into<String>) -> Self {
+        self.sni = Some(sni.into());
+        self
+    }
 }
 
 /// Announcement payload exchanged between peers for `tcp-tls`.
@@ -96,12 +104,20 @@ impl std::fmt::Debug for TcpTlsCodec {
 
 impl TcpTlsCodec {
     /// Supported options for `tcp-tls`.
-    pub const OPTIONS: &'static [ProtocolOption] = &[ProtocolOption {
-        key: "port",
-        value: "PORT",
-        help: "TCP port to listen on for TLS 1.3 connections",
-        default: Some("443"),
-    }];
+    pub const OPTIONS: &'static [ProtocolOption] = &[
+        ProtocolOption {
+            key: "port",
+            value: "PORT",
+            help: "TCP port to listen on for TLS 1.3 connections",
+            default: Some("443"),
+        },
+        ProtocolOption {
+            key: "sni",
+            value: "DOMAIN",
+            help: "Server Name Indication (SNI) domain to disguise TLS connections",
+            default: Some(crate::cert::DEFAULT_SNI),
+        },
+    ];
 
     /// Creates a new `TcpTlsCodec`.
     pub fn new(local_id: EndpointId, transport: Arc<TcpTlsTransport>) -> Self {
@@ -132,6 +148,13 @@ impl TcpTlsCodec {
                         .map_err(|_| format!("invalid port `{value}`"))?;
                     config.port = Some(port);
                 }
+                "sni" => {
+                    let trimmed = value.trim();
+                    if trimmed.is_empty() {
+                        return Err("sni domain cannot be empty".into());
+                    }
+                    config.sni = Some(trimmed.to_string());
+                }
                 other => return Err(format!("unknown option `{other}` for tcp-tls")),
             }
         }