docs(self-hosting): document Docker socket proxy permission profiles (#1798)

Adds a "Docker socket proxy" section to self-hosting that maps Sencho
features to the Docker Engine API groups a proxy must allow. Three
profiles (monitoring / minimum management / full) with literal flag
values, a feature-to-API reference table, a keep-disabled list, and the
self-update caveat: helpers always mount the host Unix socket, so a
TCP-only proxy does not carry update traffic.

Also adds a production-hardening checklist item pointing at the section,
cross-links from the feature pages whose behavior depends on mutating
Docker access (mesh, file explorer, resources, remote updates, stack
management, scheduled operations), and a pointer from Compose Doctor's
proxy findings to the sizing guidance.

Closes #1796

docs/features/stack-file-explorer.mdx

@@ -38,6 +38,10 @@ The same source mounted by more than one service is shown as a single root, summ
   Editing a config file does not restart the service that reads it. After you save, restart the relevant service so it picks up the new content.
 </Note>
 
+<Note>
+  Browsing a named volume works by creating a short-lived helper container through the Docker API. When Sencho runs behind a Docker socket proxy, the proxy must allow CONTAINERS (create, attach, start, wait, remove) and POST for volume browsing to work. See [Self-Hosting: Docker socket proxy](/operations/self-hosting#docker-socket-proxy).
+</Note>
+
 ### When a volume cannot be browsed
 
 A volume root shows a short explanation in place of its tree and is not browsable when: