feat(monitors): a DNS monitor can name a resolver; the host page puts Ansible above Docker (#5214)

DNS monitors take an optional Resolver, a server's IP. Set, the check asks
that server directly for A and AAAA over UDP and records how long it took
to answer; empty keeps today's lookup through the container's resolver.
"Does my local DNS still answer for public names" and "does 1.1.1.1" are
now separate monitors. No new dependency.

On a host's page the Ansible card moves above the Docker list, which can
run to dozens of containers and hid it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/hosts/detail.html

@@ -150,13 +150,7 @@
 </div>
 </div>{# Monitors + Agent grid #}
 
-{# ── Docker (docker plugin fragment; renders nothing if the host has none);
-   above Ansible: containers are state to read, Ansible is something to do ──── #}
-{% if "docker" in enabled_plugins %}
-<div hx-get="/plugins/docker/host/{{ host.id }}" hx-trigger="load" hx-swap="innerHTML"></div>
-{% endif %}
-
-{# ── Ansible (full width) ─────────────────────────────────────────────────── #}
+{# ── Ansible (full width), before Docker ───────────────────────────────────── #}
 <div class="card">
   <h3 class="section-title">Ansible</h3>
   {% if linked_target %}
@@ -243,6 +237,13 @@
   {% endif %}
 </div>{# Ansible card #}
 
+{# ── Docker (docker plugin fragment; renders nothing if the host has none).
+   After Ansible: the container list can run long, and Ansible beneath it was
+   easy to miss (#5214). ─────────────────────────────────────────────────────── #}
+{% if "docker" in enabled_plugins %}
+<div hx-get="/plugins/docker/host/{{ host.id }}" hx-trigger="load" hx-swap="innerHTML"></div>
+{% endif %}
+
 {# ── SNMP (renders nothing unless a configured SNMP device maps to this host) ── #}
 {% if "snmp" in enabled_plugins %}
 <div hx-get="/plugins/snmp/host/{{ host.id }}" hx-trigger="load" hx-swap="innerHTML"></div>