TLS handshake error when using Cloudfront as CDN

I'm seeing this in `kamal proxy logs -f` for any request made from Cloudfront to the Rails app (Thruster). Cloudfront itself throws a 502 error screen.

```
2024-10-06T16:07:51.540795855Z {"time":"2024-10-06T16:07:51.54066842Z","level":"INFO","msg":"http: TLS handshake error from 64.252.114.216:24268: unknown server name"}
```

Kamal proxy settings:

```
proxy:
ssl: true
host: ****** (app's domain)
```

Start with the CloudFront-to-Thruster request path and reproduce the 502 while following `kamal proxy logs -f` with the shown proxy settings. Check how the requested hostname is handled against the configured app domain; done means CloudFront requests complete without the TLS “unknown server name” error or 502.

Written by the indexing model from the issue text.