[SandObserver]

Summary

• Add POST /api/docker/test, which probes an address for a Docker API via /version and reports whether it is usable.
• Separate a wrong address (refused connection, unresolvable name, unreachable network, non-Docker service, 4xx) from one that is only not answering yet, so a timeout warns instead of refusing.
• Refuse the General save when Docker monitoring is on and the probe rejects the address, alongside the existing password refusals and before any write.
• Report an unverified address as a warning once the save has landed, rather than in place of it.
• Export pingErrorText and errCode from the proxy so the probe reuses the existing error-code vocabulary.
• Drop the fixed 30px image size from the app editor's icon preview redraw, leaving the stylesheet's proportional rule to size it in the 34px tile.
• Number preview attempts so a late failure from a superseded keystroke cannot reset the tile to the letter placeholder.
• Document why every container-checked app can turn red at once, and why a socket proxy service name and a published port are not interchangeable addresses.
• Replace a real LAN address in a docker-compose.yml comment with the placeholder used elsewhere.

Testing
All green. Added 9 tests for the socket proxy probe and 2 for the icon preview.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.