internal/cli: consolidate duplicated SNI-DNS check

[dolonet]

Pure refactor extracted from the now-closed #474, against current master (so it sits cleanly on top of #505).

Problem

Doctor.checkSecretHost (internal/cli/doctor.go) and warnSNIMismatch (internal/cli/run_proxy.go) each carry their own copy of the same routine:

1. resolve the secret hostname over DNS;
2. determine the server's public IPv4/IPv6 — config first, getIP fallback;
3. compare the resolved records against those public IPs.

Three steps, two copies, kept in sync by hand.

Change

The data-gathering moves into runSNICheck (new internal/cli/sni_check.go), which returns an sniCheckResult — resolved records, the two public IPs, per-family match booleans, and any resolve error.

The success verdict stays with each caller, on purpose: the two are not the same check. doctor reports ✅ when any family matches; the startup warning stays silent only when every detected family matches. Sharing the verdict would silently change one of them — so only the gathering is consolidated.

No behavior change

Both callers produce byte-identical output and the same return values as before:

• doctor — same ✅/❌ templates (including doctor: surface both public IPs in SNI-DNS mismatch message #505's wording), same matched-IP shown in the success line, same return bool.
• warnSNIMismatch — same log lines, same ipv4_match/ipv6_match bindings, same early-returns.

getIP is unchanged and still called sequentially per family.

Verification

• go build ./..., go vet ./..., go test ./... — all clean.
• gofmt clean on the three touched files (the one unrelated alignment nit gofmt reports in doctor.go is pre-existing in the Doctor struct tags and left untouched).

Splitting note: #474 also proposed a network.public-ip-endpoints config option. That's a config-surface change rather than a refactor, so it is intentionally not here — I'll raise it separately for your call.