feat(monitors): a DNS monitor can name a resolver; the host page puts Ansible above Docker (#5214)

DNS monitors take an optional Resolver, a server's IP. Set, the check asks
that server directly for A and AAAA over UDP and records how long it took
to answer; empty keeps today's lookup through the container's resolver.
"Does my local DNS still answer for public names" and "does 1.1.1.1" are
now separate monitors. No new dependency.

On a host's page the Ansible card moves above the Docker list, which can
run to dozens of containers and hid it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/hosts/detail.html

@@ -150,13 +150,7 @@
 </div>
 </div>{# Monitors + Agent grid #}
 
-{# ── Docker (docker plugin fragment; renders nothing if the host has none);
-   above Ansible: containers are state to read, Ansible is something to do ──── #}
-{% if "docker" in enabled_plugins %}
-<div hx-get="/plugins/docker/host/{{ host.id }}" hx-trigger="load" hx-swap="innerHTML"></div>
-{% endif %}
-
-{# ── Ansible (full width) ─────────────────────────────────────────────────── #}
+{# ── Ansible (full width), before Docker ───────────────────────────────────── #}
 <div class="card">
   <h3 class="section-title">Ansible</h3>
   {% if linked_target %}
@@ -243,6 +237,13 @@
   {% endif %}
 </div>{# Ansible card #}
 
+{# ── Docker (docker plugin fragment; renders nothing if the host has none).
+   After Ansible: the container list can run long, and Ansible beneath it was
+   easy to miss (#5214). ─────────────────────────────────────────────────────── #}
+{% if "docker" in enabled_plugins %}
+<div hx-get="/plugins/docker/host/{{ host.id }}" hx-trigger="load" hx-swap="innerHTML"></div>
+{% endif %}
+
 {# ── SNMP (renders nothing unless a configured SNMP device maps to this host) ── #}
 {% if "snmp" in enabled_plugins %}
 <div hx-get="/plugins/snmp/host/{{ host.id }}" hx-trigger="load" hx-swap="innerHTML"></div>

steward/templates/monitors/_fields.html

@@ -10,7 +10,7 @@
 <p class="field-hint mfield" data-types="http" style="grid-column:1/-1;margin:0;">
   <strong>HTTP</strong> requests the target URL (http:// or https://). Up when the status matches, and the page contains the text below if you set one. For https, the certificate's expiry is tracked too.</p>
 <p class="field-hint mfield" data-types="dns" style="grid-column:1/-1;margin:0;">
-  <strong>DNS</strong> looks the target name up (google.com, nas.lan, …) through the resolver Steward's container uses. Up when it resolves, and to the expected IP if you set one. No response time is recorded.</p>
+  <strong>DNS</strong> looks the target name up (google.com, nas.lan, …). Up when it resolves, and to the expected IP if you set one. With no resolver it asks the way Steward's container does (its resolv.conf, so usually your local DNS) and records no response time; name a resolver (1.1.1.1, your router, …) to ask that server directly and time its answer.</p>
 
 {# tcp #}
 <div class="mfield" data-types="tcp">
@@ -24,6 +24,12 @@
   <input type="text" name="expected_ip" value="{{ config.get('expected_ip') or '' }}"
          placeholder="e.g. 192.0.2.10" autocomplete="off" class="input">
 </div>
+<div class="mfield" data-types="dns">
+  <label class="field-label">Resolver <span style="color:var(--text-dim);">(optional)</span></label>
+  <input type="text" name="resolver" value="{{ config.get('resolver') or '' }}"
+         placeholder="the container's own" autocomplete="off" class="input"
+         title="A DNS server's IP address to ask directly. Empty asks the way Steward's container does.">
+</div>
 
 {# http #}
 <div class="mfield" data-types="http">

steward/templates/monitors/detail.html

@@ -134,6 +134,9 @@
     <dd style="overflow-wrap:anywhere;">{{ value|join(", ") if value is mapping else ("yes" if value is sameas true else ("no" if value is sameas false else value)) }}</dd>
     {% endif %}
     {% endfor %}
+    {% if monitor.type == "dns" and not monitor.config.get("resolver") %}
+    <dt>Resolver</dt><dd>the container's own (its resolv.conf)</dd>
+    {% endif %}
   </dl>
 </section>
 {% endblock %}