feat(syslog): set-up help on the page, port 5514 published, Docker-hidden senders called out (#6003)

The Syslog page says where to send (this server, its port and protocols) and
where the setting is on Synology, QNAP, TrueNAS, OpenWrt, UniFi and rsyslog,
open until a device sends. A sender whose address is on Steward's own
container network (Swarm ingress publishing hides the real sender) is
flagged, with the host-mode ports to publish instead. compose files and the
Dockerfile publish 5514/udp and /tcp; docs/plugins/syslog.md describes the
plugin and the deploy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/plugins/syslog/test_network.py

@@ -0,0 +1,27 @@
+"""Whether a sender's address is Docker's (#6003): the container's own
+networks read from /proc/net/route."""
+import ipaddress
+
+from plugins.syslog.network import on_own_network, subnets_from
+
+# A swarm task on the ingress network (10.0.0.0/24) and an overlay (10.0.5.0/24),
+# with its default route through the bridge gateway 172.18.0.1.
+ROUTE = """Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT
+eth1	00000000	010012AC	0003	0	0	0	00000000	0	0	0
+eth0	0000000A	00000000	0001	0	0	0	00FFFFFF	0	0	0
+eth2	0005000A	00000000	0001	0	0	0	00FFFFFF	0	0	0
+eth1	000012AC	00000000	0001	0	0	0	0000FFFF	0	0	0
+eth9	nonsense
+"""
+
+
+def test_the_directly_connected_networks_are_read_the_default_route_left_out():
+    assert subnets_from(ROUTE) == [ipaddress.IPv4Network("10.0.0.0/24"), ipaddress.IPv4Network("10.0.5.0/24"),
+                                   ipaddress.IPv4Network("172.18.0.0/16")]
+
+
+def test_a_sender_on_a_container_network_is_flagged_and_a_lan_one_is_not():
+    nets = subnets_from(ROUTE)
+    assert on_own_network("10.0.0.2", nets) and on_own_network("172.18.0.1", nets)
+    assert not on_own_network("192.168.1.20", nets)
+    assert not on_own_network("not an address", nets) and not on_own_network("10.0.0.2", [])