chore(deploy): NO_PROXY defaults for downloaders; explain library root modes

- compose: app gets a default NO_PROXY (UMT_NO_PROXY) listing compose
  service names incl. qbittorrent / qbittorrent-nox / qb / transmission /
  deluge / aria2, so a proxy override never swallows downloader traffic.
- runbook: proxy and test-qB override templates use the same list.
- Settings: one-line hint on library root "管理方式" (managed vs
  register_only).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/components/settings/instances.tsx

@@ -347,6 +347,8 @@ export function LibraryRootsTable() {
               { value: "register_only", label: "只登记" },
               { value: "managed", label: "自动维护（补齐、升级）" },
             ],
+            hint: "自动维护：自动整理可把新下载放进来，文件管理可在其中改名、移动、删除；只登记：只扫描登记已有文件，不自动写入也不可改动。",
+            wide: true,
           },
           { name: "enabled", label: "启用", kind: "switch" },
           { name: "notes", label: "备注", kind: "textarea" },