feat(samba): settings registry + smb.conf/compose renderers (R-7 slice 1, Part 1)

SMBSettings + SMBShare registry in settings (password never stored — only UserSet);
NetBIOS-safe name validation. Pure infra renderers: RenderSambaConfig (hardened
global block: SMB2 floor, bind interfaces only=lo eth0, disable netbios=no, force
user block) + RenderSambaCompose (network_mode host, pinned image, :ro bind for
read-only shares, passdb volume). Exact smb.conf golden + CRUD/validation tests.

controller/internal/infra/infra.go

@@ -25,6 +25,9 @@ const (
 	TraefikImage     = "traefik:v3.6.7"
 	CloudflaredImage = "cloudflare/cloudflared:2026.6.0"
 	FileBrowserImage = "gtstef/filebrowser:1.3.3-stable"
+	// SambaImage is our own pinned LAN-sharing image (R-7 slice 1). Built by
+	// controller/scripts/build-samba-image.sh from controller/infra-images/samba/. NEVER :latest.
+	SambaImage = "gitea.dooplex.hu/admin/felhom-samba:1.0.0"
 )
 
 //go:embed templates/*.tmpl