fix(image-updates): normalize docker.io host aliases to the registry API host (#1706)

* fix(image-updates): normalize docker.io host aliases to the registry API host

parseImageRef kept a literal `docker.io` or `index.docker.io` host when the
user wrote an explicit registry prefix, so every downstream request hit the
marketing domain instead of registry-1.docker.io and failed with an
unhandled 3xx. Normalize both aliases before the library/ auto-prefix check
so explicit and implicit Docker Hub refs resolve identically.

* test(image-updates): pin docker.io alias parity and drop redundant coverage

Add the index.docker.io namespace-omitted parseImageRef case and a
buildRollbackTarget assertion for an explicit docker.io/ ref, and drop
the compareLocalToRemoteTag traefik-shape test that only duplicated
existing attestation-manifest coverage. Also clarify the canonicalRegistry
doc comment now that it and parseImageRef normalize to different forms.

* docs(image-updates): correct canonicalRegistry comment's call-path example

* test(image-updates): collapse docker.io alias cases into a single it.each

backend/src/__tests__/update-preview-service.test.ts

@@ -432,6 +432,15 @@ describe('buildSummary', () => {
         expect(buildSummary('stacky', images).rollback_target).toBe('postgres:16');
     });
 
+    it('computes rollback target for an explicit docker.io/ ref the same as the bare form', () => {
+        // docker.io is a Docker Hub alias normalized by parseImageRef; the rollback target
+        // must render the same shortened form as the bare-name case above, not the literal host.
+        const images = [
+            baseImage({ service: 'db', image: 'docker.io/library/postgres:16', has_update: true, semver_bump: 'patch', next_tag: '16', current_tag: '16' }),
+        ];
+        expect(buildSummary('stacky', images).rollback_target).toBe('postgres:16');
+    });
+
     it('computes rollback target for registry with port', () => {
         const images = [
             baseImage({