feat(samba): settings registry + smb.conf/compose renderers (R-7 slice 1, Part 1)

SMBSettings + SMBShare registry in settings (password never stored — only UserSet);
NetBIOS-safe name validation. Pure infra renderers: RenderSambaConfig (hardened
global block: SMB2 floor, bind interfaces only=lo eth0, disable netbios=no, force
user block) + RenderSambaCompose (network_mode host, pinned image, :ro bind for
read-only shares, passdb volume). Exact smb.conf golden + CRUD/validation tests.

controller/internal/settings/settings.go

@@ -94,6 +94,14 @@ type Settings struct {
 	// Offbox is the off-box (NAS) restic-SFTP backup target (Part B). One per box. No secrets here —
 	// the repo password + SSH key are 0600 files in the data dir.
 	Offbox *OffboxTarget `json:"offbox,omitempty"`
+
+	// SMB holds the LAN network-sharing (Samba) feature state (R-7 slice 1). The household SMB
+	// password is NEVER stored here — only UserSet records that one exists (it lives in the samba
+	// container's passdb volume). nil = feature never touched (disabled). See internal/settings/smb.go.
+	SMB *SMBSettings `json:"smb,omitempty"`
+	// SMBShares is the ordered registry of exported folders. Each Path is an absolute host path under
+	// a registered storage root; the smb.conf + compose + backup classification all ride this list.
+	SMBShares []SMBShare `json:"smb_shares,omitempty"`
 }
 
 // AppEmail holds the global app-email toggle and an optional household display name.