fix(samba): separate storage-ROOT validation from share-TARGET validation

Live validation caught it: the 'new folder' flow passed the storage root through
sharingResolvePath, which (correctly) refuses the drive root as a share target —
so share creation silently failed. sharingResolveStorageRoot accepts EXACTLY a
registered live root (strictly tighter) and is used only as the new-folder parent.
Regression test asserts both halves.

controller/internal/web/sharing_handlers.go

@@ -82,6 +82,39 @@ func (s *Server) sharingResolvePath(raw string) (string, error) {
 	return resolved, nil
 }
 
+// sharingResolveStorageRoot validates a storage ROOT chosen for the "new folder" flow.
+//
+// This is deliberately NOT sharingResolvePath: that one validates a SHARE TARGET and therefore
+// refuses the drive root itself (a whole drive is never shareable). Here the root is not the share —
+// the new folder is created UNDER it — so the accept condition is "is EXACTLY a registered, live
+// storage root", which is strictly tighter than the share-target guard.
+func (s *Server) sharingResolveStorageRoot(raw string) (string, error) {
+	if strings.TrimSpace(raw) == "" {
+		return "", errNotShareable
+	}
+	clean := filepath.Clean(raw)
+	if !filepath.IsAbs(clean) {
+		return "", errNotShareable
+	}
+	resolved, err := filepath.EvalSymlinks(clean)
+	if err != nil {
+		return "", errNotShareable
+	}
+	for _, sp := range s.settings.GetStoragePaths() {
+		if sp.Decommissioned || sp.Disconnected {
+			continue
+		}
+		spResolved, serr := filepath.EvalSymlinks(sp.Path)
+		if serr != nil {
+			spResolved = filepath.Clean(sp.Path)
+		}
+		if filepath.Clean(resolved) == filepath.Clean(spResolved) {
+			return resolved, nil
+		}
+	}
+	return "", errNotShareable
+}
+
 // sharingPageData assembles the „Megosztás" page state.
 func (s *Server) sharingPageData() map[string]interface{} {
 	data := s.settingsBaseData("sharing", "Hálózati megosztás")
@@ -216,7 +249,7 @@ func (s *Server) sharingShareCreateHandler(w http.ResponseWriter, r *http.Reques
 	var target string
 	switch mode {
 	case "new":
-		root, err := s.sharingResolvePath(r.FormValue("storage_root"))
+		root, err := s.sharingResolveStorageRoot(r.FormValue("storage_root"))
 		if err != nil {
 			sharingRedirect(w, r, errNotShareable.Error())
 			return