conn->tls_hostname defaults to NULL and can be cleared via "no tls hostname". Writing it unconditionally emitted a "tls hostname (null)" line, producing a config that does not re-parse. Guard it like the other optional tls fields.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Change-Id: I5b920337409d8c9fa1edb8d47177882cf0a6c4e7
