Address round-two review: rename mtglib privates, reorder, more tests

- mtglib/proxy.go: rename private field domainFrontingIP -> domainFrontingHost
  and update DomainFrontingAddress() doc comment to reflect that hostnames
  are now accepted. The exported mtglib.ProxyOpts.DomainFrontingIP is
  unchanged (public API), so the assignment in NewProxy now reads
  `domainFrontingHost: opts.DomainFrontingIP,` which makes the
  public-vs-internal naming explicitly visible at the boundary.
- internal/config/{parse,config}.go: reorder so Host comes before IP in
  the [domain-fronting] struct. Cosmetic, but signals Host is the
  preferred forward path.
- Add TestDomainFrontingHostAcceptsLiteralIP + domain_fronting_host_ip.toml
  fixture exercising the documented "host accepts hostname or literal IP"
  contract end-to-end.

internal/config/config.go

 	PublicIPv4                  TypeIP          `json:"publicIpv4"`
 	PublicIPv6                  TypeIP          `json:"publicIpv6"`
 	DomainFronting              struct {
-		IP            TypeIP   `json:"ip"`
 		Host          TypeHost `json:"host"`
+		IP            TypeIP   `json:"ip"`
 		Port          TypePort `json:"port"`
 		ProxyProtocol TypeBool `json:"proxyProtocol"`
 	} `json:"domainFronting"`

internal/config/config_test.go

 	suite.Equal("fronting-backend", conf.GetDomainFrontingHost())
 }
 
+func (suite *ConfigTestSuite) TestDomainFrontingHostAcceptsLiteralIP() {
+	conf, err := config.Parse(suite.ReadConfig("domain_fronting_host_ip.toml"))
+	suite.NoError(err)
+	suite.NoError(conf.Validate())
+	suite.Equal("10.0.0.1", conf.GetDomainFrontingHost())
+}
+
 func (suite *ConfigTestSuite) TestDomainFrontingIPFromTOML() {
 	conf, err := config.Parse(suite.ReadConfig("domain_fronting_ip.toml"))
 	suite.NoError(err)

internal/config/parse.go

 	PublicIPv4                  string `toml:"public-ipv4" json:"publicIpv4,omitempty"`
 	PublicIPv6                  string `toml:"public-ipv6" json:"publicIpv6,omitempty"`
 	DomainFronting              struct {
-		IP            string `toml:"ip" json:"ip,omitempty"`
 		Host          string `toml:"host" json:"host,omitempty"`
+		IP            string `toml:"ip" json:"ip,omitempty"`
 		Port          uint   `toml:"port" json:"port,omitempty"`
 		ProxyProtocol bool   `toml:"proxy-protocol" json:"proxyProtocol,omitempty"`
 	} `toml:"domain-fronting" json:"domainFronting,omitempty"`

internal/config/testdata/domain_fronting_host_ip.toml

+secret = "7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t"
+bind-to = "0.0.0.0:3128"
+
+[domain-fronting]
+host = "10.0.0.1"

mtglib/proxy.go

 	idleTimeout                 time.Duration
 	handshakeTimeout            time.Duration
 	domainFrontingPort          int
-	domainFrontingIP            string
+	domainFrontingHost          string
 	domainFrontingProxyProtocol bool
 	workerPool                  *ants.PoolWithFunc
 	telegram                    *dc.Telegram
 }
 
 // DomainFrontingAddress returns a host:port pair for a fronting domain.
-// If DomainFrontingIP is set, it is used instead of resolving the hostname.
+// If a fronting host (literal IP or hostname) is configured, it is used
+// instead of resolving the secret's hostname.
 func (p *Proxy) DomainFrontingAddress() string {
 	host := p.secret.Host
-	if p.domainFrontingIP != "" {
-		host = p.domainFrontingIP
+	if p.domainFrontingHost != "" {
+		host = p.domainFrontingHost
 	}
 
 	return net.JoinHostPort(host, strconv.Itoa(p.domainFrontingPort))
 		eventStream:              opts.EventStream,
 		logger:                   logger,
 		domainFrontingPort:       opts.getDomainFrontingPort(),
-		domainFrontingIP:         opts.DomainFrontingIP,
+		domainFrontingHost:       opts.DomainFrontingIP,
 		tolerateTimeSkewness:     opts.getTolerateTimeSkewness(),
 		idleTimeout:              opts.getIdleTimeout(),
 		handshakeTimeout:         opts.getHandshakeTimeout(),