Address self-review: rename helper, end-to-end TOML tests

Follow-up to the previous commit on this branch:

- Rename Config.GetDomainFrontingIP -> GetDomainFrontingHost. The
  helper now returns a hostname or an IP, so the old name was a lie.
  Drop the unused defaultValue net.IP parameter (every caller passed
  nil). Update internal/cli/run_proxy.go and internal/cli/doctor.go;
  rename the misleading `ip` local var in doctor.go to `override`.

- Add TOML fixtures (domain_fronting_host.toml, domain_fronting_ip.toml)
  so the new field is exercised through the actual Parse()->JSON->Config
  path users hit, not just via direct .Set() calls. Plus a positive
  backward-compat test confirming an `ip`-only legacy config still
  validates and resolves correctly, and a no-fronting test confirming
  the unset case returns empty.

- Clarify example.config.toml: `ip` is kept for backward compatibility,
  not because it has stricter validation semantics worth choosing over
  `host`.

mtglib.ProxyOpts.DomainFrontingIP keeps its name (public API).

example.config.toml

 # back to this server (e.g. mtg sits behind an SNI router whose DNS points
 # at itself), override the destination here.
 #
-# Use `host` for a hostname (resolved at dial time, so a dual-stack DNS
-# record can reach the right backend address family for IPv4 or IPv6
-# clients) or for a literal IP. Use `ip` if you specifically need a
-# literal IP and want strict IP validation. Setting both is an error.
+# Use `host` — accepts a hostname or a literal IP. Hostnames are resolved
+# at dial time, so a dual-stack DNS record can reach the right backend
+# address family for IPv4 or IPv6 clients. `ip` is kept for backward
+# compatibility (literal IP only). Setting both is an error.
 #
 # The hostname from the secret is still used for SNI in the TLS handshake.
 #

internal/cli/doctor.go

 
 func (d *Doctor) checkFrontingDomain(ntw mtglib.Network) bool {
 	host := d.conf.Secret.Host
-	if ip := d.conf.GetDomainFrontingIP(nil); ip != "" {
-		host = ip
+	if override := d.conf.GetDomainFrontingHost(); override != "" {
+		host = override
 	}
 
 	port := d.conf.GetDomainFrontingPort(mtglib.DefaultDomainFrontingPort)

internal/cli/run_proxy.go

 		Secret:                      conf.Secret,
 		Concurrency:                 conf.GetConcurrency(mtglib.DefaultConcurrency),
 		DomainFrontingPort:          conf.GetDomainFrontingPort(mtglib.DefaultDomainFrontingPort),
-		DomainFrontingIP:            conf.GetDomainFrontingIP(nil),
+		DomainFrontingIP:            conf.GetDomainFrontingHost(),
 		DomainFrontingProxyProtocol: conf.GetDomainFrontingProxyProtocol(false),
 		PreferIP:                    conf.PreferIP.Get(mtglib.DefaultPreferIP),
 		AutoUpdate:                  conf.AutoUpdate.Get(false),

internal/config/config.go

 	"bytes"
 	"encoding/json"
 	"fmt"
-	"net"
 	"net/url"
 
 	"github.com/9seconds/mtg/v2/mtglib"
 	return c.DomainFrontingPort.Get(defaultValue)
 }
 
-func (c *Config) GetDomainFrontingIP(defaultValue net.IP) string {
+func (c *Config) GetDomainFrontingHost() string {
 	if host := c.DomainFronting.Host.Get(""); host != "" {
 		return host
 	}
 	if ip := c.DomainFronting.IP.Get(nil); ip != nil {
 		return ip.String()
 	}
-	if ip := c.DomainFrontingIP.Get(defaultValue); ip != nil {
+	if ip := c.DomainFrontingIP.Get(nil); ip != nil {
 		return ip.String()
 	}
 	return ""

internal/config/config_test.go

 	suite.NotEmpty(conf.String())
 }
 
-func (suite *ConfigTestSuite) TestDomainFrontingHostOrIP() {
+func (suite *ConfigTestSuite) TestDomainFrontingHostAndIPMutuallyExclusive() {
 	conf, err := config.Parse(suite.ReadConfig("minimal.toml"))
 	suite.NoError(err)
 
 	suite.NoError(conf.DomainFronting.Host.Set("fronting-backend"))
 	suite.NoError(conf.DomainFronting.IP.Set("10.0.0.10"))
 	suite.Error(conf.Validate())
+}
 
-	suite.Equal("fronting-backend", conf.GetDomainFrontingIP(nil))
+func (suite *ConfigTestSuite) TestDomainFrontingHostFromTOML() {
+	conf, err := config.Parse(suite.ReadConfig("domain_fronting_host.toml"))
+	suite.NoError(err)
+	suite.NoError(conf.Validate())
+	suite.Equal("fronting-backend", conf.GetDomainFrontingHost())
+}
+
+func (suite *ConfigTestSuite) TestDomainFrontingIPFromTOML() {
+	conf, err := config.Parse(suite.ReadConfig("domain_fronting_ip.toml"))
+	suite.NoError(err)
+	suite.NoError(conf.Validate())
+	suite.Equal("10.0.0.10", conf.GetDomainFrontingHost())
+}
+
+func (suite *ConfigTestSuite) TestDomainFrontingNotSet() {
+	conf, err := config.Parse(suite.ReadConfig("minimal.toml"))
+	suite.NoError(err)
+	suite.NoError(conf.Validate())
+	suite.Equal("", conf.GetDomainFrontingHost())
 }
 
 func TestConfig(t *testing.T) {

internal/config/testdata/domain_fronting_host.toml

+secret = "7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t"
+bind-to = "0.0.0.0:3128"
+
+[domain-fronting]
+host = "fronting-backend"

internal/config/testdata/domain_fronting_ip.toml

+secret = "7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t"
+bind-to = "0.0.0.0:3128"
+
+[domain-fronting]
+ip = "10.0.0.10"