Import image modal: register container images from canonicals and NGC catalog URLs

## Summary

Superadmins can register a container image that is not yet in Backend.AI by pasting NGC catalog URLs, \`docker pull\` lines or image canonicals into an **Add image** modal on Environments › Images. Each line is parsed client-side, matched against the registered container registries, and submitted to \`POST /admin/images/rescan\` (\`canonical\` + \`architecture\`).

Origin: USC customer request — NGC NIM / AI containers (~800) with new versions every two weeks; the core team confirmed NGC cannot be catalog-scanned and only single-image rescans work, today only from the manager CLI.

## Scope

- **Button**: "Add Image" in the Images list action row beside "Install Image"; rendered only when \`baiClient.is_superadmin && baiClient.supports('scan-image-by-canonical')\` (the Environments route is admin-scoped, the endpoint is superadmin-only).
- **Modal**: one multi-line text area; per-line live preview (registry match, project, image, tag or "tag required", reason codes); collapsed "Advanced" field with \`architecture\` (default \`x86_64\`, applies to all lines).
- **Parser** (\`parseImageReference\`): NGC catalog URLs (canonical \`orgs/{org}/{team|-}/containers/{name}/{tag|-}\`, \`teams/\` short form, \`/tags/{tag}\` deep link, legacy \`org:team:name\`, scheme-less), \`docker|podman pull\` lines (prompt/\`sudo\` prefixes), canonicals (host with port, multi-segment project). Tag comes from the URL when present, otherwise the line is not submittable — never defaulted to \`latest\`. Registry/project split is resolved by literal prefix match against registered \`registry_name[/project]\` rows: 0 → \`registry_not_registered\`, ≥2 → \`registry_ambiguous\` (backend raises). Reject list: \`tag_required\`, \`digest_unsupported\`, \`scheme_in_canonical\`, \`host_required\`, \`invalid_tag\`, \`invalid_reference\`, \`empty_image_name\`, \`ngc_not_a_container\`, \`ngc_url_unparseable\`, \`unsupported_command\`. Unit tests from the 63 research vectors.
- **Unregistered registry**: opens \`ContainerRegistryEditorModal\` stacked on top, pre-filled (host + first path segment); on create, the registry list is refetched and lines re-validate.
- **Submission**: sequential POSTs; all succeed → toast + close + \`updateFetchKey()\`; any failure → modal stays open, per-line status, succeeded lines locked, failed lines editable, "Retry failed". Error classification on \`statusCode\` / \`error_code\` (404 \`image_read_not-found\` = manager cannot register new images yet; 500 without body = tag/manifest not found; 403 = not superadmin).
- **i18n**: \`environment.AddImage\` family in \`resources/i18n/en.json\` (+ \`ko.json\`; others via \`make i18n\`, \`th.json\` by hand). No row highlight, no search filter.

## Out of scope

Regular-user self-service, tag-list picker (needs a manager proxy API), automatic newest-tag tracking, Docker Hub catalog URLs.

## Prerequisite (lablup/backend.ai)

\`POST /admin/images/rescan\` currently resolves the image from the DB first and returns 404 for images not yet registered; it must fall back to the CLI's DB-independent path (\`rescan_images(registry_or_image=canonical)\`), populate \`errors\`, and return a clean 404 for a missing tag. Tracked as a core issue linked from this task.

## Context

Wayfinder map FR-3933. Research: input grammar https://github.com/lablup/backend.ai-webui/blob/research/add-image-input-grammar/docs/research/add-image-input-grammar.md · WebUI plumbing https://github.com/lablup/backend.ai-webui/blob/research/add-image-webui-plumbing/docs/research/add-image-webui-plumbing.md. Top of a two-PR stack on the ContainerRegistryEditorModal pre-fill task.

JIRA Issue: FR-3940

Start with docs/research/add-image-input-grammar.md and docs/research/add-image-webui-plumbing.md, then trace the Images list action row, Add Image modal, and ContainerRegistryEditorModal. Verify the 63 parser vectors and the rescan submission flow, including retry and error states. Done means supported references can be previewed, registered, submitted, retried when needed, and localized as specified, with the backend prerequisite available.

Written by the indexing model from the issue text.