feat(settings): add reserved hosts field and surface NAT errors

Add the reserved_hosts setting (input + i18n across all locales) so operators
behind a reverse proxy can declare public dashboard hostnames members must not
register as NAT domains (GHSA-x6fg-52vr-hj4w).

Show the backend error message on NAT create/update failure instead of a
generic "unexpected error", so a reserved-host rejection is explained.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

src/locales/zh-TW/translation.json

@@ -147,6 +147,8 @@
     "CustomCodes": "自訂程式碼（樣式和腳本）",
     "CustomCodesDashboard": "儀表板的自訂程式碼",
     "DashboardOriginalHost": "Agent對接位址【網域名稱/IP:連接埠】",
+    "ReservedHosts": "保留 Host（逗號分隔；反代/公網網域，成員不可註冊為 NAT 網域）",
+    "ReservedHostsHint": "反代部署下面板看不到自身的對外網域，無法自動保護。請在此列出所有公網入口網域，否則成員可將其註冊為 NAT 網域搶佔面板路由。",
     "ConfigTLS": "Agent 使用 TLS 連線",
     "CustomPublicDNSNameserversforDDNS": "DDNS 的自訂公共 DNS 名稱伺服器",
     "WebRealIPHeader": "前端真實IP請求頭",