fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

GHSA-x6fg-52vr-hj4w: NAT is a commonHandler any authenticated member can
create, and newHTTPandGRPCMux matches r.Host against NAT before dispatching
the dashboard/gRPC handlers, so a member could register the dashboard's own
host as a NAT Domain and hijack global routing. Add IsReservedDashboardHost
(InstallHost/ListenHost plus an operator-declared ReservedHosts list for
reverse-proxy deployments), reject reserved hosts on create/update, and drop
pre-planted records when building the startup cache.

GHSA-39g2-8x68-pmx8: bind-time CheckPermission let a member pre-bind a DDNS
profile ID that the victim would only create later. GetDDNSProvidersFromProfiles
now re-validates ownership by server owner UID and skips foreign-owned
profiles (UserID==0 is treated as a migration artifact, not an admin grant).

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

cmd/dashboard/controller/setting_reserved_hosts_test.go

@@ -0,0 +1,24 @@
+package controller
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/nezhahq/nezha/model"
+)
+
+// GHSA-x6fg-52vr-hj4w: the admin settings endpoint must accept reserved_hosts
+// so a reverse-proxy operator can declare the public dashboard hostnames the
+// process itself never sees. Without binding here, the only way to set the
+// field would be hand-editing the YAML, defeating the in-product guard.
+func TestSettingForm_BindsReservedHosts(t *testing.T) {
+	body := []byte(`{"site_name":"X","reserved_hosts":"panel.example.com, admin.example.com"}`)
+	var sf model.SettingForm
+	if err := json.NewDecoder(bytes.NewReader(body)).Decode(&sf); err != nil {
+		t.Fatal(err)
+	}
+	if sf.ReservedHosts != "panel.example.com, admin.example.com" {
+		t.Fatalf("reserved_hosts must decode into SettingForm, got %q", sf.ReservedHosts)
+	}
+}