fix: resolve Docker socket permissions and notification page routing

- Add runtime Docker socket permission detection in entrypoint
  - Detects socket GID and logs helpful deployment guidance
  - Provides three resolution options (root user, group-add, or chmod)
  - Non-intrusive: logs only, doesn't modify permissions

- Fix notification page routing mismatch
  - Move notifications route from /notifications to /settings/notifications
  - Add notifications tab to Settings page with Bell icon
  - Align navigation structure with route definitions

- Enhance Docker API error handling
  - Return 503 (not 500) when Docker daemon unavailable
  - Add DockerUnavailableError type for clear error distinction
  - Implement SSRF hardening (reject arbitrary host values)

- Improve security and testability
  - Move ProxyHost routes to protected auth group
  - Refactor Docker handler tests to use mocks
  - Simplify useDocker hook query enablement logic

Docker socket fix addresses deployment-level permission issue without
code changes. The 503 error correctly signals service unavailability
due to configuration, not application bugs.

Closes #XX (if applicable)

frontend/src/components/Layout.tsx

@@ -72,14 +72,13 @@ export default function Layout({ children }: LayoutProps) {
       { name: t('navigation.waf'), path: '/security/waf', icon: '🛡️' },
       { name: t('navigation.securityHeaders'), path: '/security/headers', icon: '🔐' },
     ]},
-    { name: t('navigation.notifications'), path: '/notifications', icon: '🔔' },
-    // Import group moved under Tasks
     {
       name: t('navigation.settings'),
       path: '/settings',
       icon: '⚙️',
       children: [
         { name: t('navigation.system'), path: '/settings/system', icon: '⚙️' },
+        { name: t('navigation.notifications'), path: '/settings/notifications', icon: '🔔' },
         { name: t('navigation.email'), path: '/settings/smtp', icon: '📧' },
         { name: t('navigation.adminAccount'), path: '/settings/account', icon: '🛡️' },
         { name: t('navigation.accountManagement'), path: '/settings/account-management', icon: '👥' },
@@ -93,7 +92,6 @@ export default function Layout({ children }: LayoutProps) {
         {
           name: t('navigation.import'),
           path: '/tasks/import',
-          icon: '📥',
           children: [
             { name: t('navigation.caddyfile'), path: '/tasks/import/caddyfile', icon: '📥' },
             { name: t('navigation.crowdsec'), path: '/tasks/import/crowdsec', icon: '🛡️' },