feat(settings): add reserved hosts field and surface NAT errors

Add the reserved_hosts setting (input + i18n across all locales) so operators
behind a reverse proxy can declare public dashboard hostnames members must not
register as NAT domains (GHSA-x6fg-52vr-hj4w).

Show the backend error message on NAT create/update failure instead of a
generic "unexpected error", so a reserved-host rejection is explained.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

src/components/nat.tsx

@@ -82,10 +82,11 @@ export const NATCard: React.FC<NATCardProps> = ({ data, mutate }) => {
             } else {
                 await createNAT(values)
             }
-        } catch (e) {
+        } catch (e: unknown) {
             console.error(e)
             toast(t("Error"), {
-                description: t("Results.UnExpectedError"),
+                description:
+                    e instanceof Error && e.message ? e.message : t("Results.UnExpectedError"),
             })
             return
         }