Add a daily Docker image-update notification

Dockhand's pending-update counts were only visible if you happened to
open the Docker page. New "Docker image update available" toggle
under Settings -> Notifications, sharing the same daily
time/timezone as the secret and Tailscale key expiry reminders (same
node-schedule reschedule-on-settings-change pattern as those two).
Reads each enabled Dockhand integration's already-cached update-check
results via listContainers() rather than triggering a fresh
per-container registry lookup, so it costs nothing extra beyond what
the Docker page itself already fetches, and lists every container
with an update pending across all environments/integrations in one
notification.

Verified end-to-end against a fake local Dockhand server (one
environment, two containers, one flagged with a pending update) and a
fake webhook receiver on an isolated scratch database: the check
correctly found only the flagged container (with its newerVersion),
sent exactly one notification with the right title/content, excluded
the up-to-date container, and sent nothing at all when the setting
was toggled off despite still finding the same pending update.
Confirmed the real dev database's mtime was untouched throughout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server/src/services/settingsStore.ts

@@ -40,7 +40,8 @@ export interface NotificationEvents {
   dnsDelete: boolean;
   secretCheck: boolean;
   tailscaleKeyCheck: boolean;
-  secretCheckTime: string; // "HH:MM" — shared by the secret-expiry and Tailscale key-expiry checks
+  dockerUpdateCheck: boolean;
+  secretCheckTime: string; // "HH:MM" — shared by the secret-expiry, Tailscale key-expiry, and Docker update checks
   timezone: string;
   integrationFailureAlerts: boolean;
   /** Consecutive failed calls (from the Diagnostic Log) before an integration/DNS provider is considered down. */
@@ -91,6 +92,7 @@ const DEFAULTS: AppSettings = {
     dnsDelete: true,
     secretCheck: true,
     tailscaleKeyCheck: true,
+    dockerUpdateCheck: true,
     secretCheckTime: "08:00",
     timezone: "UTC",
     integrationFailureAlerts: true,