feat(monitors): a DNS monitor can name a resolver; the host page puts Ansible above Docker (#5214)

DNS monitors take an optional Resolver, a server's IP. Set, the check asks
that server directly for A and AAAA over UDP and records how long it took
to answer; empty keeps today's lookup through the container's resolver.
"Does my local DNS still answer for public names" and "does 1.1.1.1" are
now separate monitors. No new dependency.

On a host's page the Ansible card moves above the Docker list, which can
run to dozens of containers and hid it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/mcp/tools/monitors.py

@@ -174,7 +174,9 @@ async def create_monitor(name: str, type: str, target: str, host: str = "",
       free-standing destination.
     config, by type (every key optional, defaults shown):
       tcp:  {"port": 80}
-      dns:  {"expected_ip": null}  (set to fail when the name resolves elsewhere)
+      dns:  {"expected_ip": null, "resolver": null}  (expected_ip: fail when the
+             name resolves elsewhere; resolver: a DNS server's IP to ask
+             directly, timing its answer; null asks the container's own)
       http: {"method": "GET" | "HEAD" | "POST", "expected_status": 200,
              "content_match": "", "headers": {}, "timeout_seconds": 10 (1-60),
              "follow_redirects": true, "verify_ssl": true}