feat(settings): add reserved hosts field and surface NAT errors

Add the reserved_hosts setting (input + i18n across all locales) so operators
behind a reverse proxy can declare public dashboard hostnames members must not
register as NAT domains (GHSA-x6fg-52vr-hj4w).

Show the backend error message on NAT create/update failure instead of a
generic "unexpected error", so a reserved-host rejection is explained.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

src/routes/settings.tsx

@@ -7,6 +7,7 @@ import { Combobox } from "@/components/ui/combobox"
 import {
     Form,
     FormControl,
+    FormDescription,
     FormField,
     FormItem,
     FormLabel,
@@ -44,6 +45,7 @@ const settingFormSchema = z.object({
     language: z.string().min(2),
     user_template: z.string().min(1),
     install_host: asOptionalField(z.string()),
+    reserved_hosts: asOptionalField(z.string()),
     custom_code: asOptionalField(z.string()),
     custom_code_dashboard: asOptionalField(z.string()),
     web_real_ip_header: asOptionalField(z.string()),
@@ -290,6 +292,20 @@ export default function SettingsPage() {
                                 </FormItem>
                             )}
                         />
+                        <FormField
+                            control={form.control}
+                            name="reserved_hosts"
+                            render={({ field }) => (
+                                <FormItem>
+                                    <FormLabel>{t("ReservedHosts")}</FormLabel>
+                                    <FormControl>
+                                        <Input {...field} />
+                                    </FormControl>
+                                    <FormDescription>{t("ReservedHostsHint")}</FormDescription>
+                                    <FormMessage />
+                                </FormItem>
+                            )}
+                        />
                         <FormField
                             control={form.control}
                             name="tls"