When testing a notification webhook URL through the settings UI, the
"Test" button now surfaces the validator's reason instead of a generic
"Invalid notification service URL." message. For private/internal IP
rejections that the operator can unblock (loopback, RFC1918, CGNAT,
link-local, IPv6 private), the error message names
`LDR_NOTIFICATIONS_ALLOW_PRIVATE_IPS`; for NAT64-wrapped non-metadata
destinations on IPv6-only deployments (RFC 6052 well-known
`64:ff9b::/96` or RFC 8215 local-use `64:ff9b:1::/48`) it names
`LDR_SECURITY_ALLOW_NAT64` — the only flag that can unblock those, which
the hint probes for independently. Cloud-metadata IPs are always blocked and
the env-var hint is intentionally suppressed for them — neither flag
re-opens metadata, so naming them would mislead the user.

Also adds an "IPv6-only deployments (NAT64)" subsection to
`docs/SearXNG-Setup.md` so operators routing IPv4 through NAT64 know
about the opt-in.
