feat(samba): felhom-samba infra image (R-7 slice 1, Part 0)

Own pinned alpine image (3.21@sha256:48b0309c) + smbd/nmbd/wsdd/tini. Dumb by
design: smb.conf bind-mounted read-only, no baked name/password, passdb on a
volume. Three-daemon stack per the R-6 spike verdict (nmbd required alongside
wsdd, else Explorer double-click 0x80070035). build-samba-image.sh helper.

controller/infra-images/samba/Dockerfile

@@ -0,0 +1,27 @@
+# felhom-samba — the LAN SMB-sharing infra image for felhom-controller (R-7 slice 1).
+#
+# DUMB BY DESIGN: /etc/samba/smb.conf is bind-mounted READ-ONLY by the controller, which
+# owns all rendering. This image templates nothing and bakes NO share name and NO password.
+# The three-daemon discovery stack is the spike verdict
+# (felhom.eu/documentation/audits/SPIKE-lan-discovery-2026-07-18.md, S4/S4b):
+#   - smbd  : the SMB/CIFS server (445)
+#   - nmbd  : NetBIOS name service — REQUIRED alongside wsdd. wsdd-only makes the box visible
+#             in Explorer but the double-click fails 0x80070035 (no flat-name resolution);
+#             nmbd is what makes \\<NAME> resolve + mount (S4b, proven live).
+#   - wsdd  : WS-Discovery, so the box appears in Windows Explorer's Network view.
+FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
+
+# samba = smbd + nmbd + smbpasswd/testparm (meta-package proven installable in the spike);
+# wsdd = WS-Discovery daemon; tini = a proper PID1 to reap nmbd/wsdd and forward signals.
+RUN apk add --no-cache samba wsdd tini \
+    && rm -rf /var/cache/apk/* \
+    && rm -f /etc/samba/smb.conf
+
+# passdb on a named volume → the household SMB password survives container recreation
+# (share add/remove re-renders + `compose up -d`, which recreates the container).
+VOLUME ["/var/lib/samba"]
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ENTRYPOINT ["/sbin/tini", "--", "/entrypoint.sh"]

controller/infra-images/samba/entrypoint.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+# felhom-samba entrypoint (R-7 slice 1). A dumb supervisor: smb.conf is bind-mounted
+# READ-ONLY by the controller, so nothing here templates config or bakes a secret. It
+# only ensures the household unix user exists (uid:gid 1000) and launches the three
+# discovery daemons. Verdict source: SPIKE-lan-discovery-2026-07-18 (S4/S4b).
+set -e
+
+FELHOM_UID="${FELHOM_UID:-1000}"
+FELHOM_GID="${FELHOM_GID:-1000}"
+SERVER_NAME="${FELHOM_SERVER_NAME:-FELHOM}"
+IFACE="${FELHOM_IFACE:-eth0}"
+
+# Household group/user at uid:gid 1000 — files written over SMB then match the app +
+# backup ownership convention (smb.conf sets `force user = felhom` per share).
+if ! getent group "$FELHOM_GID" >/dev/null 2>&1; then
+    addgroup -g "$FELHOM_GID" felhom 2>/dev/null || true
+fi
+GRP_NAME="$(getent group "$FELHOM_GID" 2>/dev/null | cut -d: -f1)"
+[ -z "$GRP_NAME" ] && GRP_NAME=felhom
+if ! getent passwd "$FELHOM_UID" >/dev/null 2>&1; then
+    adduser -D -H -u "$FELHOM_UID" -G "$GRP_NAME" -s /sbin/nologin felhom 2>/dev/null || true
+fi
+
+mkdir -p /var/lib/samba/private /run/samba
+
+echo "[felhom-samba] launching nmbd + wsdd + smbd (server=${SERVER_NAME} iface=${IFACE} uid=${FELHOM_UID})"
+
+# nmbd: NetBIOS flat-name resolution so \\<NAME> resolves and mounts (the S4b fix).
+nmbd --daemon --no-process-group
+# wsdd: WS-Discovery so the box appears in Windows Explorer's Network view.
+wsdd -i "$IFACE" -4 -H 4 -s -n "$SERVER_NAME" -w WORKGROUP &
+# smbd in the foreground = the container's main process.
+exec smbd --foreground --no-process-group

controller/scripts/build-samba-image.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# =============================================================================
+# felhom-samba — infra image build+push helper (R-7 slice 1).
+# Run on the build server (192.168.0.180). Mirrors build.sh usage.
+#
+#   ./build-samba-image.sh 1.0.0            # build local only
+#   ./build-samba-image.sh 1.0.0 --push     # build + push to Gitea registry
+#
+# NEVER tags :latest (a floating tag breaks reproducible pins). The controller pins the
+# exact tag in the generated compose. After --push, verify ANONYMOUS pull works (the guest
+# pulls infra images without creds — same as the controller self-update path).
+# =============================================================================
+set -euo pipefail
+
+VERSION="${1:?usage: build-samba-image.sh <version> [--push]}"
+ACTION="${2:-}"
+
+REGISTRY="gitea.dooplex.hu/admin"
+IMAGE="${REGISTRY}/felhom-samba"
+CTX="$(cd "$(dirname "$0")/../infra-images/samba" && pwd)"
+
+echo "[INFO] building ${IMAGE}:${VERSION}"
+echo "[INFO] context: ${CTX}"
+docker build -t "${IMAGE}:${VERSION}" "${CTX}"
+
+if [[ "${ACTION}" == "--push" ]]; then
+    echo "[INFO] pushing ${IMAGE}:${VERSION}"
+    docker push "${IMAGE}:${VERSION}"
+    echo "[INFO] pushed. Verify anonymous pull (guest has no registry creds):"
+    echo "       docker logout ${REGISTRY%%/*} 2>/dev/null; docker pull ${IMAGE}:${VERSION}"
+else
+    echo "[INFO] local build only. To push: ./build-samba-image.sh ${VERSION} --push"
+fi