Rescan a single image from the Images list

## Summary

Add a per-row **Rescan** action to Environments › Images that refreshes one registered image's metadata from its registry through \`POST /admin/images/rescan\` (\`canonical\` + \`architecture\`). Today rescan exists only per registry (Registries tab row action, Maintenance page). For docker-type registries without a catalog API (nvcr.io), the registry-wide rescan enumerates nothing (\`container_registry/docker.py:86\` uses \`/v2/_catalog\`), so a per-image rescan is the only way to refresh an NGC image once it is imported.

What a rescan updates (\`container_registry/base.py:196-206\`): \`config_digest\` (which \`auto_pull: digest\` compares against), \`size_bytes\`, \`accelerators\`, \`labels\` (min resources, service ports, apps), and it restores a \`DELETED\` row to \`ALIVE\`.

## Scope

- Row action **Rescan** (icon button, superadmin only) in the Images list action cell, beside "Modify Minimum Image Resource Limit" / "Manage Apps".
- Reuses the scan request helper and error classification introduced by the Import Image modal (FR-3940); refetches the list on success; toast with the canonical.
- i18n \`environment.RescanImage\` family (en, ko real; others via \`make i18n\`, \`th.json\` by hand).
- Component test: success → toast + refetch; 500 with empty body → tag-not-found message; 403 → superadmin message.

## Out of scope

Bulk rescan of a selection; scheduling.

## Context

Third PR of the FR-3939 → FR-3940 stack; wayfinder map FR-3933.

JIRA Issue: FR-3948

Start at the Environments › Images list and its row action cell, then trace the scan request helper and error classification used by the Import Image modal (FR-3940). Check the environment.RescanImage translations and the component test coverage. Done means a superadmin can rescan one image, see the canonical in a success toast, see the specified 500/403 messages, and the list refetches.

Written by the indexing model from the issue text.