feat(settings): add reserved hosts field and surface NAT errors

Add the reserved_hosts setting (input + i18n across all locales) so operators
behind a reverse proxy can declare public dashboard hostnames members must not
register as NAT domains (GHSA-x6fg-52vr-hj4w).

Show the backend error message on NAT create/update failure instead of a
generic "unexpected error", so a reserved-host rejection is explained.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

src/types/api.ts

@@ -722,6 +722,8 @@ export interface ModelSetting {
     /** 系统语言，默认 zh_CN */
     language: string
     oauth2_providers: string[]
+    /** 反代部署下声明对外域名（逗号分隔），防止成员注册冲突 NAT 域名抢占路由 */
+    reserved_hosts: string
     site_name: string
     /** 用于前端判断生成的安装命令是否启用 TLS */
     tls: boolean
@@ -742,6 +744,7 @@ export interface ModelSettingForm {
     enable_mcp?: boolean
     ignored_ip_notification?: string
     install_host?: string
+    reserved_hosts?: string
     /** IP变更提醒的通知组 */
     ip_change_notification_group_id: number
     /** @minLength 2 */