agent v0.50.0: NAS network storage Part A1 (NFS/SMB automount foundation)

Host-side NFS/SMB automount of a bulk-media NAS share under /mnt/felhom-drives/<name>
(propagates into the guest via the existing shared bind), the +100000 uid recipe,
per-share liveness, and add/list/remove local-API endpoints. A NAS is a distinct class
that bypasses the drive enroll/eject/decommission/SMART/watchdog machinery.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs

internal/localapi/server.go

@@ -84,6 +84,12 @@ type Options struct {
 	// GuestAttach binds an enrolled user-data drive's felhom-data namespace into the guest (slice 10
 	// P2, Model A). OPTIONAL — when nil, POST /disks/guest-attach reports "not configured".
 	GuestAttach GuestAttacher
+	// NetStorage is the privileged network-mount (NAS) surface (Part A1). OPTIONAL — when nil, the
+	// /netstorage endpoints report "not configured". Satisfied by *storage.SudoHostOps.
+	NetStorage NetworkStorageOps
+	// SmbCredsDir is where the agent writes the 0600 SMB credentials files (out-of-band). "" →
+	// /var/lib/felhom-agent/smb-creds.
+	SmbCredsDir string
 	// ControllerSwap runs guest commands (pct exec) for the agentic controller-update swap (Phase 1).
 	// OPTIONAL — when nil, POST /controller/swap reports "not configured". Satisfied by *GuestBinder.
 	ControllerSwap GuestExecutor
@@ -158,6 +164,9 @@ type Server struct {
 	diskGate    StorageGate        // slice 8C (optional)
 	guestList   GuestLister        // slice 8C (optional)
 	guestAttach GuestAttacher      // slice 10 P2 (optional)
+	netStorage  NetworkStorageOps  // Part A1: NAS network mounts (optional)
+	netMountRoot string            // the user-data namespace root for the network-mount role gate
+	smbCredsDir  string            // where SMB creds files are written (out-of-band, 0600)
 	intent      IntentRecorder     // slice 10 P3 (optional)
 	guestBinds  *GuestBindStore    // F9 startup bind re-assert record (optional)
 	formatJobs  *FormatJobStore    // F20-BUG3 detached-format job record (optional)
@@ -225,6 +234,9 @@ func NewServer(o Options) (*Server, error) {
 		diskGate:     o.DiskGate,
 		guestList:    o.Guests2,
 		guestAttach:  o.GuestAttach,
+		netStorage:   o.NetStorage,
+		netMountRoot: storage.NetworkMountRoot,
+		smbCredsDir:  o.SmbCredsDir,
 		intent:       o.Intent,
 		guestBinds:   o.GuestBinds,
 		formatJobs:   o.FormatJobs,
@@ -268,6 +280,12 @@ func (s *Server) Handler() http.Handler {
 	// Guest reboot (slice 10 P2 activation): user-triggered restart to activate pending drive binds.
 	mux.HandleFunc("POST /guest/reboot", s.withGuest(s.handleGuestReboot))
 
+	// Network storage (NAS) — Part A1: mount/list/remove a bulk-media NAS share host-side (automount
+	// idle-unmount; +100000 uid recipe). A distinct class from a drive — no enroll/eject/wipe.
+	mux.HandleFunc("POST /netstorage/add", s.withGuest(s.handleNetStorageAdd))
+	mux.HandleFunc("GET /netstorage", s.withGuest(s.handleNetStorageList))
+	mux.HandleFunc("POST /netstorage/remove", s.withGuest(s.handleNetStorageRemove))
+
 	// agentic controller update (Phase 1): in-guest image swap + rollback, owned by the agent.
 	mux.HandleFunc("POST /controller/swap", s.withGuest(s.handleControllerSwap))
 	mux.HandleFunc("GET /controller/swap/status", s.withGuest(s.handleControllerSwapStatus))