Proxy and service upgrades

TARGET_SNI=auto uses separate TLS connection pools for normalized outbound hostnames. TARGET_HOST takes precedence. The backend address remains the configured target. The pool limit is 128 names. If every pool is active, a new name receives 503 until a pool becomes available. Malformed host authorities receive 400. DNS case, a trailing dot, and valid ports do not create separate pools.

Each systemd instance now owns /run/techaro-botstopper/<instance>. Update Unix socket paths in instance environment files and reverse-proxy configuration before restarting the service.