feat: client_dial helper — open a tcp socket and run mtls handshake

[kacy]

summary

third PR-5 chunk (after #440, #441). adds the small glue that turns
"connect to an upstream over TCP" into "connect and optionally run an
mTLS handshake, returning a session". the L7 proxy wiring (chunk 4)
calls this from forwardSingleAttempt.

self-contained; no proxy behavior change.

what's in here

new src/tls/client_dial.zig exposing:

pub const Outcome = union(enum) {
    bare: posix.fd_t,
    session: client_session.ClientSession,
};

pub fn dial(io, alloc, opts: Options) DialError!Outcome;

Options carries upstream addr/port, optional CA pem (null ⇒ stay
plaintext), optional client cert/key, optional SNI / expected SAN, and
the current unix time. the result is a tagged union so the caller
matches once and uses one of two clean apis — no fd-vs-session
conditionals threaded through every read/write call.

also adds a small parseIpv4 helper (no std.net.Address dependency
to keep the dial path lean) with positive + negative tests.

tests

real TCP listener on 127.0.0.1:<ephemeral> for both cases:

1. plaintext dial — no CA ⇒ returns .bare, listener accepts.
2. mTLS dial — full opts ⇒ a worker thread runs the production
   acceptServerHandshake on the listener side; dial returns
   .session; both sides complete cleanly.

plus two parseIpv4 truth-table tests.

not in this PR

• plumbing peer_mode through service_registry_runtime so
  resolveUpstreamWithPolicy knows which upstreams are mTLS
• switching reverse_proxy.forwardSingleAttempt's read/write loop to
  match on the dial outcome (the bigger change — touches the
  upstream-pool path too)
• handshake metrics and yoq cert service <name> CLI

still no auto-merge — security-sensitive wiring.