add in-country-validated Akamai SNIs (IR)

[myleshorton]

Summary

Adds 14 in-country-validated SNIs to the Akamai provider's masquerade pool. Source: Keith (Psiphon ops, 2026-05-24), based on aggregated client telemetry from Iran.

Akamai serves the same default cert (a248.e.akamai.net) regardless of incoming SNI, so these names are pure DPI cover — the inner Host header drives property routing as before. The Iranian domestic names (snapp.ir, varzesh3.com, aparat.com, bmi.ir, digikala.com) are particularly resilient cover — IR can't block these without breaking core domestic services.

SNIs added

Category	SNI
Python ecosystem	python.org, pypi.org, www.python.org, www.pypi.org, files.pythonhosted.org, registry.npmjs.org
US tech giants	google.com, www.google.com, go.microsoft.com
Iranian domestic	snapp.ir (ride-hailing), varzesh3.com (sports), aparat.com (video), bmi.ir (Bank Melli), digikala.com (e-commerce)

Consumer

radiance#488 extends AkamaiCandidates to consume SNIsForProvider(cfg, "akamai") and mix named SNIs alongside the existing bare-SNI strategy. Each Akamai IP gets:

• 1 bare-SNI candidate (current strategy — confirmed dominant in IR telemetry)
• Up to 3 named-SNI candidates drawn at random (without replacement) from the pool — DPI fallback for periods when bare gets blocked

Why entries have empty ipaddress

SNIsForProvider only consumes the Domain field. The empty ipaddress reflects that these are SNI-pool-only entries; the scanner pairs them with Akamai IPs discovered at probe time. The other path that uses ipaddress — CandidatesFromConfig via KnownSample > 0 — is off by default in radiance's pool config.

Verification

Smoke test (radiance ./cmd/meek-client-smoke/) against the deployed meek server confirms named-SNI candidates round-trip end-to-end:

INFO got fronts count=3 first_ip=184.28.105.132 first_sni=a248.e.akamai.net
...
{
  "origin": "139.162.181.47"
}
✅ end-to-end meek client smoke test PASSED

🤖 Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[myleshorton]

Closing — landed on the correct repo at getlantern/domainfront. getlantern/fronted is deprecated; the kindling path uses domainfront for fronted config now.