Close gateway-secret desync, TOCTOU, and undisclosed custom-image gaps

Round 4 review findings:

- Disclose and warn on a custom Docker image the import would set (HIGH):
  it's the image every project container is created from, so an
  undisclosed change here was a sharper version of the redirected-base-URL
  problem round 3 already flagged for the model backends.
- Recreate a running gateway container when an import restores a new
  secret with the shape unchanged (MEDIUM): reconcile_gateway's shape
  comparison can't see a secret-only change, so the container would
  otherwise keep serving old key material indefinitely.
- Report keychain write failures back to the caller instead of only
  logging them (MEDIUM): apply_settings_import now returns
  SettingsImportOutcome with secret_restore_warnings so a partial restore
  can't read as unqualified success.
- Pin a hash of the previewed file's ciphertext and refuse to apply if it
  changed on disk (MEDIUM): closes a TOCTOU between preview and apply.
- Sanitize and cap every free-form string a preview surfaces, and move the
  warning boxes above the replace list in the UI (MEDIUM): an unbounded
  base URL or image name could otherwise push the security warnings below
  the scroll fold.
- Validate the Docker socket path on import the same as the SSH key and CA
  cert paths (LOW): it was the one mounted host path validate_settings_update
  didn't cover.
- Fix ExportedSecrets::is_empty() to treat whitespace-only as blank, like
  every other secret-presence check in this feature (LOW).
- Authenticate the file header as AEAD associated data (LOW, defense in
  depth) and correct two doc comments that overstated the password not
  being cached.

app/src/lib/settingsImportPreview.test.ts

@@ -18,6 +18,8 @@ function preview(overrides: Partial<SettingsImportPreview> = {}): SettingsImport
     llamacpp_base_url: null,
     openai_compatible_base_url: null,
     gateway_api_base: null,
+    image_source: "registry",
+    custom_image_name: null,
     ...overrides,
   };
 }
@@ -76,6 +78,18 @@ describe("describeImport", () => {
     expect(items.some((i) => i.includes("llama.cpp"))).toBe(false);
     expect(items.some((i) => i.includes("OpenAI-compatible"))).toBe(false);
   });
+
+  it("names a custom Docker image when set, falling back to a placeholder if unnamed", () => {
+    expect(
+      describeImport(preview({ image_source: "custom", custom_image_name: "ghcr.io/me/triple-c" })),
+    ).toContain("Docker image: ghcr.io/me/triple-c");
+    expect(describeImport(preview({ image_source: "custom", custom_image_name: null }))).toContain(
+      "Docker image: (no image name set)",
+    );
+    expect(describeImport(preview({ image_source: "registry" })).some((i) => i.includes("Docker image"))).toBe(
+      false,
+    );
+  });
 });
 
 describe("describeImportWarnings", () => {
@@ -101,4 +115,11 @@ describe("describeImportWarnings", () => {
       "Includes a web terminal access token that will activate the next time the web terminal is turned on.",
     ]);
   });
+
+  it("warns about a custom Docker image every time, not only when it changes", () => {
+    expect(
+      describeImportWarnings(preview({ image_source: "custom", custom_image_name: "evil:latest" })),
+    ).toEqual(["Runs every project container from a custom Docker image: evil:latest."]);
+    expect(describeImportWarnings(preview({ image_source: "registry" }))).toEqual([]);
+  });
 });