feat(syslog): devices through Swarm's ingress told apart by name; the send-to address is a setting (#6096)

Through ingress every device arrives from Docker's own address, so a
source there is keyed by the hostname its lines carry (new column
sender, unique with address). The set-up help no longer guesses the
address from the web hostname: it shows the plugin's send_to setting,
covers ingress and host mode, ASUSTOR ADM, and both syslog formats.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plugins/syslog.md

@@ -40,7 +40,26 @@ ports:
   - "5514:5514/tcp"
 ```
 
-Under **Docker Swarm**, publish it in **host mode**:
+Under **Docker Swarm**, either publishing mode works.
+
+**Ingress** (Swarm's default) lets Steward move between nodes. Devices send to
+any node's address, or to an address shared over the nodes (a keepalived VIP):
+
+```yaml
+ports:
+  - { target: 5514, published: 5514, protocol: udp }
+  - { target: 5514, published: 5514, protocol: tcp }
+```
+
+Through ingress every line arrives from Docker's own address on the ingress
+network, so the address no longer tells the devices apart. For such an address
+Steward keys the source by the hostname each line carries instead (#6096): each
+device is its own source, linked to a host by name. A device must put its
+hostname in its lines (NASes and routers do); lines with none at Docker's
+address all fold into one source, and the page says so.
+
+**Host mode** keeps each device's own address, but only the node running the
+task answers, so devices must be pointed at that node:
 
 ```yaml
 ports:
@@ -48,20 +67,14 @@ ports:
   - { target: 5514, published: 5514, protocol: tcp, mode: host }
 ```
 
-Swarm's default (ingress) publishing hands every packet over from an address on
-the ingress network. Every device would then read as one sender, because
-sources are told apart by the address their lines come from. The Syslog page
-flags a sender whose address is on Steward's own container network.
-
-Host mode publishes the port on the node that runs the task, so point devices
-at that node. Keep the service on one node with a placement constraint, so the
-address you give the devices stays right.
-
 To let devices use 514 instead, publish `514:5514` instead of `5514:5514`.
 
 ## Pointing a device at it
 
 The Syslog page's "Point a device here" section gives the address and port,
-and where the setting is on common devices (Synology, QNAP, TrueNAS, OpenWrt,
-UniFi, rsyslog). Choose the RFC 5424 / IETF format where it is offered: those
-lines carry their time zone.
+and where the setting is on common devices (Synology, ASUSTOR, QNAP, TrueNAS,
+OpenWrt, UniFi, rsyslog). The address is the plugin's `send_to` setting
+(Settings → Plugins → Syslog): Steward's web address is often a name only its
+proxy answers, so it isn't guessed. Both formats are read, BSD (RFC 3164) and
+IETF (RFC 5424); choose IETF where it is offered, as its lines carry their time
+zone. ASUSTOR's ADM offers no choice and sends BSD.