Function peek_client_hello_sni 

pub async fn peek_client_hello_sni(
    stream: &mut TcpStream,
) -> Result<Option<String>>

Peek the TLS ClientHello SNI off a TCP stream WITHOUT splicing.

This is the peek-only half of handle_passthrough, extracted so the DW-103 L4 TCP dispatcher can reuse the EXACT SNI extraction (the same bounded reassembly, the same 64 KiB budget, the same 10s peek timeout) and then own its own splice (with an idle timeout and L4 metrics). Returns Ok(None) when the client sends no SNI, a non-TLS hello, or the peek times out. Peeking (never reading) keeps the bytes available for the upstream once splicing starts.