netstorage: verify-before-commit orchestration — agentapi verify fields, uid-1000 re-exec probe, detached add job, orphan rows

Controller half of the verify pipeline (SPIKE-nas-verify b57f6c1): AddNetStorage
gains verify/job fields + typed NetAddRefusedError; NetVerifyStatus polls the
agent slot; --netprobe hidden re-exec mode (SysProcAttr.Credential uid/gid 1000,
no shell) proves in-guest writability; the add handler starts a detached
single-flight job (agent_add → verifying → probing → registering LAST) with full
rollback on any failure incl. verify-lost-after-restart (Scenario F); §3.2
Hungarian error map server-side; live-but-unregistered shares surface as remove-
only 'Árva megosztás' rows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/cmd/controller/main.go

@@ -57,6 +57,14 @@ var (
 )
 
 func main() {
+	// Hidden re-exec mode (NAS verify-before-commit): the web server re-execs THIS binary as
+	// `felhom-controller --netprobe <dir>` with uid/gid-1000 credentials to prove a media app can
+	// write through a freshly-verified network share (SPIKE-nas-verify Q2). Handled before flag
+	// parsing; the exit code is the probe verdict (see web/netprobe.go).
+	if len(os.Args) == 3 && os.Args[1] == "--netprobe" {
+		os.Exit(web.NetProbeChild(os.Args[2]))
+	}
+
 	configPath := flag.String("config", "/opt/docker/felhom-controller/controller.yaml", "Path to configuration file")
 	showVersion := flag.Bool("version", false, "Show version and exit")
 	flag.Parse()