### Problem to Solve When the GitLab backend sits behind a GCP Private Service Connect endpoint, the PSC address doesn't match the TLS certificate issued for the actual GitLab hostname. The GitLab client can't connect because TLS verification fails — the cert is for e.g. `staging.gitlab.com` but the connection goes to the PSC internal address. ### Proposed Solution Add an optional `resolve_host` config field to `GitlabClientConfiguration`. When set, reqwest's `resolve()` overrides DNS for the `base_url` domain so the TCP connection routes through the PSC gateway while TLS SNI and certificate validation still use the original hostname. This avoids disabling TLS verification entirely.