feat(nfs): per-host NFS options (IP/CIDR with own ro/async/squash flags)

This is a backward-compatible MINOR bump (0.4.0 → 0.5.0).

BREAKING NOTES (for users upgrading from pre-0.5.0):
- The nfs_exports.clients column schema changed from []string to
  []NFSClient (per-host options). A migration (0005) transforms existing
  string arrays into object arrays, taking export-level options as
  defaults for each host.
- ValidateNFSClient now only accepts IPv4 (192.168.1.1) or IPv4/CIDR
  (192.168.1.0/24). Hostnames, wildcards, netgroups are rejected.
- If you use NASCTL_IMPORT_ON_BOOT, re-import your /etc/exports to pick
  up per-host options.

What changed:
- NFSClient type: {host, read_only, async, root_squash, subtree_check, advanced}
- NFSExport.Clients is now []NFSClient (was []string)
- export-level flags (ro/async/root_squash/subtree_check/advanced) are
  preserved as template defaults for newly added hosts in the UI.
- buildExportLine generates: path host1(ro,sync,...) host2(rw,async,...) fsid=N
- ValidateNFSClient: strict IPv4/CIDR only (0-255 octets, /0-32 prefix)
- parseExportLine now parses per-host options from /etc/exports (previously
  only the first host's options were kept, others were discarded)
- UI: per-host rows with toggles (ro/async/root_squash/subtree_check) and
  advanced options (all_squash, secure, wdelay, hide, crossmnt)

internal/db/queries_nfs.go

@@ -2,6 +2,7 @@ package db
 
 import (
 	"database/sql"
+	"encoding/json"
 	"fmt"
 	"regexp"
 	"strconv"
@@ -9,6 +10,28 @@ import (
 	"github.com/darroyo/nasctl/internal/system"
 )
 
+func encodeNFSClients(clients []NFSClient) (string, error) {
+	if clients == nil {
+		clients = []NFSClient{}
+	}
+	data, err := json.Marshal(clients)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+func decodeNFSClients(raw string) ([]NFSClient, error) {
+	if raw == "" {
+		return []NFSClient{}, nil
+	}
+	var clients []NFSClient
+	if err := json.Unmarshal([]byte(raw), &clients); err != nil {
+		return nil, err
+	}
+	return clients, nil
+}
+
 func scanNFSExport(row interface {
 	Scan(dest ...any) error
 }) (NFSExport, error) {
@@ -31,7 +54,7 @@ func scanNFSExport(row interface {
 		return NFSExport{}, err
 	}
 	var err error
-	export.Clients, err = decodeJSONStrings(clients)
+	export.Clients, err = decodeNFSClients(clients)
 	if err != nil {
 		return NFSExport{}, err
 	}
@@ -80,7 +103,7 @@ func (d *DB) GetNFSExport(id int64) (NFSExport, error) {
 }
 
 func (d *DB) CreateNFSExport(export NFSExport) (NFSExport, error) {
-	clients, err := encodeJSONStrings(export.Clients)
+	clients, err := encodeNFSClients(export.Clients)
 	if err != nil {
 		return NFSExport{}, err
 	}
@@ -120,7 +143,7 @@ func (d *DB) CreateNFSExport(export NFSExport) (NFSExport, error) {
 }
 
 func (d *DB) UpdateNFSExport(id int64, export NFSExport) (NFSExport, error) {
-	clients, err := encodeJSONStrings(export.Clients)
+	clients, err := encodeNFSClients(export.Clients)
 	if err != nil {
 		return NFSExport{}, err
 	}