feat: unify built-in image registry routing

[bugkeep]

Summary

• keep all seven built-in image references on their canonical registries
• add imageRegistryMirror = auto | always | never with auto as the default
• in auto, probe https://registry-1.docker.io/v2/ once at startup with a 4-second timeout; any HTTP response, including 401, means Docker Hub is reachable
• enable containerd mirror hosts only when the selected mode requires them, while retaining the canonical registries as fallbacks
• return the same Docker Hub and Kubernetes registry hosts.toml files from the manual worker join API when mirrors are enabled
• make registry routing independent of the optional SOCKS5 proxy setting

Compatibility

• auto preserves direct official-registry access where it works and enables mirrors only when the Docker Hub probe cannot connect
• always and never provide explicit overrides; invalid values reject startup
• containerd's config_path remains configured so administrators can manage their own certs.d entries
• switching mirrors off removes only hosts.toml files marked as generated by CasOS; administrator-managed files are preserved
• existing SOCKS5 application proxy behavior is unchanged

Validation

• fork verification: feat: unify built-in image registry routing bugkeep/casos#169
• Running Go tests, Back-end, Go-Linter, Front-end, and UI tests passed on a7fa5261
• temporary local tests covered mirror file generation, transition cleanup, administrator-file preservation, and cleanup error propagation; no test file is included in this PR
• go test ./...
• go vet ./...
• go build ./...