fix(updater): treat docker.io/ as Docker Hub, not a third-party registry

The registry helpers rejected any repo containing a dotted host segment,
which caught 'docker.io/authelia/authelia' — Docker Hub spelled out in
full. Those apps were silently skipped by tag enumeration and version
laddering. Strip the docker.io/ and index.docker.io/ prefixes before the
host check; genuinely third-party registries (ghcr.io, quay.io, lscr.io)
are still correctly skipped.

Found by auditing every app's anchor image.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/cli/commands/updater/cli_updater_ladder.sh

@@ -36,6 +36,7 @@ updaterTagSortKey() {
 # ladder is built by PROBING each candidate, never by enumerating.
 updaterTagExists() {
     local repo="${1%%:*}" tag="$2"
+    repo="${repo#docker.io/}"; repo="${repo#index.docker.io/}"   # docker.io/ IS Hub
     case "$repo" in *.*/*|localhost/*) return 1 ;; esac        # non-Hub: unknown
     case "$repo" in */*) : ;; *) repo="library/$repo" ;; esac
     command -v curl >/dev/null 2>&1 || return 1

scripts/webui/data/generators/updater/webui_updater_scan.sh

@@ -122,6 +122,11 @@ updaterRegistryDigest() {
 # they are returned newest-first and we only care about ones ABOVE the current.
 updaterRegistryTags() {
     local repo="${1%%:*}"                       # strip any :tag
+    # docker.io/ IS Docker Hub, just spelled out — several apps write it that
+    # way (docker.io/authelia/authelia). Stripping the prefix before the
+    # host check stops those being mistaken for a third-party registry and
+    # silently skipped.
+    repo="${repo#docker.io/}"; repo="${repo#index.docker.io/}"
     case "$repo" in
         *.*/*|localhost/*) return 0 ;;          # a real registry host — not Hub
     esac