feat: add invalid_users directive for Samba shares

Samba shares now support an 'invalid users' list (deny list), written
as 'invalid users = u1,u2' in smb.conf. The UI shows a ChipPicker
for valid_users and invalid_users, mutually exclusive, sourced from
the system user list.

feat: add ImportSystemUsers for fresh installations

When NASCTL_IMPORT_ON_BOOT=true, nasctl now imports existing system
users from /etc/passwd (UID 1000-60000) and /etc/group (supplemental
groups), and detects which have Samba accounts via 'pdbedit -L'.
Imported users are marked dirty so the admin can review before applying.
New POST /api/import/users endpoint for manual re-import.

This mirrors the existing import-on-boot flow for smb.conf and /etc/exports.

internal/db/queries_users.go

@@ -201,6 +201,35 @@ func (d *DB) ClearDeletedUser(username string) error {
 	return nil
 }
 
+func (d *DB) ReplaceUsers(users []User) error {
+	tx, err := d.conn.Begin()
+	if err != nil {
+		return fmt.Errorf("begin tx: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	if _, err := tx.Exec(`DELETE FROM system_users`); err != nil {
+		return fmt.Errorf("clear system_users: %w", err)
+	}
+
+	for _, u := range users {
+		groups, err := encodeJSONStrings(u.Groups)
+		if err != nil {
+			return err
+		}
+		_, err = tx.Exec(`
+			INSERT INTO system_users (username, groups, smb_enabled, disabled, pending_password)
+			VALUES (?, ?, ?, ?, '')`,
+			u.Username, groups, boolToInt(u.SMBEnabled), boolToInt(u.Disabled),
+		)
+		if err != nil {
+			return fmt.Errorf("insert user %s: %w", u.Username, err)
+		}
+	}
+
+	return tx.Commit()
+}
+
 func (d *DB) GetAdminByUsername(username string) (Admin, error) {
 	row := d.conn.QueryRow(
 		`SELECT id, username, password_hash, created_at, updated_at FROM admins WHERE username = ?`,