v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

R-1111 reserveAttempt is the one limiter body (share password, escrow re-auth, dashboard sign-in). R-1112
family.json holds fingerprints; old files are converted at load. R-1113 the household's pass reuses its
family session. R-1109 the samba compose carries the smb.conf hash. R-1110 TestNoBareDrivePathToPathHelpers.
R-1114 shared_scripts.py resolves the felhom.eu sibling from a worktree. Each red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/share_handlers.go

@@ -114,13 +114,14 @@ func (s *Server) shareGuestPasswordHandler(w http.ResponseWriter, r *http.Reques
 		return
 	}
 	ip := rateKey(r)
-	if s.shareRateLimited(ip) {
+	// R-1111: the try is reserved BEFORE the slow compare (the R-983 shape). Before, it was counted only after a
+	// wrong password, so N parallel tries all passed the check. Pinned by TestR1111_ParallelSharePasswordsHitTheLimit.
+	if !s.shareReserve(ip) {
 		s.logger.Printf("[WARN] [web] share password rate limited for %s", ip)
 		s.renderSharePasswordPage(w, r, s.msg(r, "api.share.too_many_attempts"))
 		return
 	}
-	if bcrypt.CompareHashAndPassword([]byte(pwHash), []byte(r.FormValue("password"))) != nil {
-		s.shareRegisterFailure(ip)
+	if s.comparePassword([]byte(pwHash), []byte(r.FormValue("password"))) != nil {
 		s.renderSharePasswordPage(w, r, s.msg(r, "flash.share.wrong_password")) // R-577: in the visitor's language
 		return
 	}