Function peek_sni 

async fn peek_sni(
    client: &mut TcpStream,
    timeout: Duration,
) -> (Option<String>, Vec<u8>)

Reads (consuming) the start of the connection until the SNI is resolved, EOF, the 8 KiB cap, or the timeout. Returns the hostname (if any) and the bytes consumed so they can be replayed to the upstream. Any short / garbage / timeout path yields (None, buf) so the caller uses the default pool.