feat: add invalid_users directive for Samba shares

Samba shares now support an 'invalid users' list (deny list), written
as 'invalid users = u1,u2' in smb.conf. The UI shows a ChipPicker
for valid_users and invalid_users, mutually exclusive, sourced from
the system user list.

feat: add ImportSystemUsers for fresh installations

When NASCTL_IMPORT_ON_BOOT=true, nasctl now imports existing system
users from /etc/passwd (UID 1000-60000) and /etc/group (supplemental
groups), and detects which have Samba accounts via 'pdbedit -L'.
Imported users are marked dirty so the admin can review before applying.
New POST /api/import/users endpoint for manual re-import.

This mirrors the existing import-on-boot flow for smb.conf and /etc/exports.

internal/web/auth.go

@@ -196,6 +196,7 @@ type Server struct {
 	Auth           *AuthService
 	SMBConfPath    string
 	ExportsPath    string
+	AdminUsername  string
 	UploadMaxBytes  int64
 	PreviewMaxBytes int64
 }
@@ -205,6 +206,7 @@ type Options struct {
 	Auth            *AuthService
 	SMBConfPath     string
 	ExportsPath     string
+	AdminUsername   string
 	UploadMaxBytes  int64
 	PreviewMaxBytes int64
 }
@@ -223,6 +225,7 @@ func NewServer(database *db.DB, eng *engine.Engine, opts Options) *Server {
 		Auth:           opts.Auth,
 		SMBConfPath:    opts.SMBConfPath,
 		ExportsPath:    opts.ExportsPath,
+		AdminUsername:  opts.AdminUsername,
 		UploadMaxBytes:  opts.UploadMaxBytes,
 		PreviewMaxBytes: opts.PreviewMaxBytes,
 	}