feat: add invalid_users directive for Samba shares

Samba shares now support an 'invalid users' list (deny list), written
as 'invalid users = u1,u2' in smb.conf. The UI shows a ChipPicker
for valid_users and invalid_users, mutually exclusive, sourced from
the system user list.

feat: add ImportSystemUsers for fresh installations

When NASCTL_IMPORT_ON_BOOT=true, nasctl now imports existing system
users from /etc/passwd (UID 1000-60000) and /etc/group (supplemental
groups), and detects which have Samba accounts via 'pdbedit -L'.
Imported users are marked dirty so the admin can review before applying.
New POST /api/import/users endpoint for manual re-import.

This mirrors the existing import-on-boot flow for smb.conf and /etc/exports.

internal/db/models.go

@@ -25,16 +25,17 @@ type Admin struct {
 }
 
 type SambaShare struct {
-	ID          int64     `json:"id"`
-	Name        string    `json:"name"`
-	Path        string    `json:"path"`
-	Comment     string    `json:"comment"`
-	ReadOnly    bool      `json:"read_only"`
-	GuestOK     bool      `json:"guest_ok"`
-	ValidUsers  []string  `json:"valid_users"`
-	ValidGroups []string  `json:"valid_groups"`
-	CreatedAt   time.Time `json:"created_at"`
-	UpdatedAt   time.Time `json:"updated_at"`
+	ID           int64     `json:"id"`
+	Name         string    `json:"name"`
+	Path         string    `json:"path"`
+	Comment      string    `json:"comment"`
+	ReadOnly     bool      `json:"read_only"`
+	GuestOK      bool      `json:"guest_ok"`
+	ValidUsers   []string  `json:"valid_users"`
+	ValidGroups  []string  `json:"valid_groups"`
+	InvalidUsers []string  `json:"invalid_users"`
+	CreatedAt    time.Time `json:"created_at"`
+	UpdatedAt    time.Time `json:"updated_at"`
 }
 
 type NFSClient struct {