feat(monitors): a DNS monitor can name a resolver; the host page puts Ansible above Docker (#5214)

DNS monitors take an optional Resolver, a server's IP. Set, the check asks
that server directly for A and AAAA over UDP and records how long it took
to answer; empty keeps today's lookup through the container's resolver.
"Does my local DNS still answer for public names" and "does 1.1.1.1" are
now separate monitors. No new dependency.

On a host's page the Ansible card moves above the Docker list, which can
run to dozens of containers and hid it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/models/monitors.py

@@ -53,7 +53,7 @@ class Monitor(Base):
     # Type-specific config as a JSON object. Keys by type:
     #   icmp -> {}
     #   tcp  -> {"port": int}
-    #   dns  -> {"expected_ip": str | None}
+    #   dns  -> {"expected_ip": str | None, "resolver": str | None (a server IP; None = the container's)}
     #   http -> {"method", "expected_status", "content_match", "headers",
     #            "timeout_seconds", "follow_redirects", "verify_ssl"}
     config_json: Mapped[str] = mapped_column(Text, nullable=False, default="{}")