Review follow-ups:

- Run the IPv4 and IPv6 detection in runSNICheck concurrently. With
  the new three-endpoint fallback in getIP, sequential detection could
  extend proxy startup by up to 30s per family on a slow/blocked
  network. Parallel detection bounds the worst case to roughly 30s
  total instead of 60s.
- Make sniCheckResult.OK() self-consistent: it now returns false when
  the hostname cannot be resolved or no public IP family is known,
  so callers cannot mistakenly treat 'cannot check' as 'all clear'.