feat: add invalid_users directive for Samba shares

Samba shares now support an 'invalid users' list (deny list), written
as 'invalid users = u1,u2' in smb.conf. The UI shows a ChipPicker
for valid_users and invalid_users, mutually exclusive, sourced from
the system user list.

feat: add ImportSystemUsers for fresh installations

When NASCTL_IMPORT_ON_BOOT=true, nasctl now imports existing system
users from /etc/passwd (UID 1000-60000) and /etc/group (supplemental
groups), and detects which have Samba accounts via 'pdbedit -L'.
Imported users are marked dirty so the admin can review before applying.
New POST /api/import/users endpoint for manual re-import.

This mirrors the existing import-on-boot flow for smb.conf and /etc/exports.

internal/web/router.go

@@ -39,6 +39,7 @@ func NewRouter(s *Server) chi.Router {
 			protected.Get("/import/status", s.handleImportStatus)
 			protected.Post("/import/samba", s.handleImportSamba)
 			protected.Post("/import/nfs", s.handleImportNFS)
+			protected.Post("/import/users", s.handleImportUsers)
 
 			protected.Route("/samba/shares", func(shares chi.Router) {
 				shares.Get("/", s.handleListSambaShares)