Let operators deploy dev Docker Hub tags from the update center

The update center previously surfaced stable Docker Hub candidates but
left dev and branch-tag rollouts stranded in SSH and Helm commands.
This adds a repo-native manual Docker tag entrypoint in Settings so
operators can deploy dev, branch, temporary, or sha tags through the
existing helper flow without changing the backend deploy contract.

Constraint: Keep the existing helper API and digest-aware Helm contract unchanged
Constraint: Preserve stable Docker Hub candidate discovery for default reminders
Rejected: Expand automatic Docker Hub discovery to all branch tags | would blur stable release reminders with operator-only rollout targets
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep automatic candidate detection stable-first; manual tag deploy is the escape hatch for non-stable tags
Tested: update-center focused vitest suite; typecheck; build:web; docs:build; repo:drift-check
Not-tested: Full npm test remains red due to unrelated tmp/sub2api frontend suites and an existing firstByteTimeout unhandled error

docs/k3s-update-center.md

@@ -308,6 +308,11 @@ helper 端使用：
 - `GitHub Releases`
 - `Docker Hub`
 
+补充一点：
+
+- `Docker Hub` 里的**自动发现**仍然优先 `latest` / `main` / 稳定 SemVer 标签
+- 如果你要部署 `dev`、分支名、临时标签或 `sha-*` 这类非稳定标签，直接在 Docker Hub 卡片底部用“手动部署 Docker Hub 标签”填写即可
+
 对已经跑起来的 K3s / Helm 用户来说，更新中心的日常配置主要就在这一页：
 
 ```text
@@ -325,7 +330,7 @@ helper 端使用：
    - 版本来源发现了可部署版本
    - 如果 Docker Hub 显示的是 `latest @ sha256:...`，说明页面已经识别到 alias tag 当前指向的具体镜像 digest
    - Deploy Helper 显示健康
-4. 再点部署按钮
+4. 如果你要跟随稳定候选，直接点部署按钮；如果你要切到 `dev` / 分支 / 临时标签，就在 Docker Hub 卡片底部手动填写 tag，必要时连 digest 一起填
 5. 在页面下方看部署日志
 6. 如果升级后发现问题，可以直接在“回退历史”里点旧 revision 回滚；只要该 revision 当时记录了 digest，就会跟着一起回到对应镜像