feat(samba): Megosztas page + guarded folder picker (R-7 slice 1, Part 3)

New top-nav category with the Halozati megosztas page: enable/server-name card,
household password, shares table (Nev/Mappa/Irasvedett/Felhomentes/Torles), and
a create flow (new folder under <storage>/shares or an existing folder via the
browse modal). Every customer path goes through sharingResolvePath: absolute ->
EvalSymlinks -> containment in a registered live storage root -> deny-listed
system subtree check -> is-a-directory. Refusals are UNIFORM so the picker is
never a filesystem oracle. Deny-list derived from ProtectedHDDPaths (provably a
subset); the drive root is an exact-match denial so user-data folders under it
stay shareable. samba infra metadata + i-share icon. Gates green.

controller/internal/web/inframeta.go

@@ -31,6 +31,12 @@ var infraMetaMap = map[string]InfraMeta{
 		Description: "Fájlkezelő — a tárhely fájljainak böngészése a böngészőből.",
 		Linked:      true,
 	},
+	// R-7: the LAN sharing stack has no web UI of its own (it is reached from Windows Intéző /
+	// Mac Finder), so Linked stays false — it is configured on the „Megosztás" page.
+	"samba": {
+		DisplayName: "Hálózati megosztás",
+		Description: "Fájlmegosztás a helyi hálózaton — a mappák a Windows Intézőben és a Mac Finderben jelennek meg.",
+	},
 }
 
 // infraMetaFor returns the curated metadata for a protected infra stack, nil for