[SandObserver]

Summary

• Return a hint from POST /api/docker/test naming which address shape failed: a service name needing a shared Docker network, or an address needing its port published where a container can reach it.
• Treat a timeout on a literal address as a refusal rather than a warning, since a port bound on another namespace's loopback drops packets instead of refusing them, and that is the commonest wrong address.
• Append the translated remedy for the hint to both the refusal and the warning raised on save.
• Rewrite the socket URL settings hint to state what each address shape requires, and link it to the troubleshooting section.
• Expand that section with the compose fragments for joining the proxy's network and for republishing its port on the Docker bridge address, including why network_mode: bridge resolves no service name and why 0.0.0.0 is worth avoiding.

Testing
All green. Added 3 tests covering both hints and the timeout reclassification.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.