feat(nfs): per-host NFS options (IP/CIDR with own ro/async/squash flags)

This is a backward-compatible MINOR bump (0.4.0 → 0.5.0).

BREAKING NOTES (for users upgrading from pre-0.5.0):
- The nfs_exports.clients column schema changed from []string to
  []NFSClient (per-host options). A migration (0005) transforms existing
  string arrays into object arrays, taking export-level options as
  defaults for each host.
- ValidateNFSClient now only accepts IPv4 (192.168.1.1) or IPv4/CIDR
  (192.168.1.0/24). Hostnames, wildcards, netgroups are rejected.
- If you use NASCTL_IMPORT_ON_BOOT, re-import your /etc/exports to pick
  up per-host options.

What changed:
- NFSClient type: {host, read_only, async, root_squash, subtree_check, advanced}
- NFSExport.Clients is now []NFSClient (was []string)
- export-level flags (ro/async/root_squash/subtree_check/advanced) are
  preserved as template defaults for newly added hosts in the UI.
- buildExportLine generates: path host1(ro,sync,...) host2(rw,async,...) fsid=N
- ValidateNFSClient: strict IPv4/CIDR only (0-255 octets, /0-32 prefix)
- parseExportLine now parses per-host options from /etc/exports (previously
  only the first host's options were kept, others were discarded)
- UI: per-host rows with toggles (ro/async/root_squash/subtree_check) and
  advanced options (all_squash, secure, wdelay, hide, crossmnt)

internal/db/models.go

@@ -37,10 +37,19 @@ type SambaShare struct {
 	UpdatedAt   time.Time `json:"updated_at"`
 }
 
+type NFSClient struct {
+	Host         string      `json:"host"`
+	ReadOnly     bool        `json:"read_only"`
+	Async        bool        `json:"async"`
+	RootSquash   bool        `json:"root_squash"`
+	SubtreeCheck bool        `json:"subtree_check"`
+	Advanced     NFSAdvanced `json:"advanced"`
+}
+
 type NFSExport struct {
 	ID           int64     `json:"id"`
 	Path         string    `json:"path"`
-	Clients      []string  `json:"clients"`
+	Clients      []NFSClient `json:"clients"`
 	ReadOnly     bool      `json:"read_only"`
 	Async        bool      `json:"async"`
 	RootSquash   bool      `json:"root_squash"`