feat(nfs): per-host NFS options (IP/CIDR with own ro/async/squash flags)

This is a backward-compatible MINOR bump (0.4.0 → 0.5.0).

BREAKING NOTES (for users upgrading from pre-0.5.0):
- The nfs_exports.clients column schema changed from []string to
  []NFSClient (per-host options). A migration (0005) transforms existing
  string arrays into object arrays, taking export-level options as
  defaults for each host.
- ValidateNFSClient now only accepts IPv4 (192.168.1.1) or IPv4/CIDR
  (192.168.1.0/24). Hostnames, wildcards, netgroups are rejected.
- If you use NASCTL_IMPORT_ON_BOOT, re-import your /etc/exports to pick
  up per-host options.

What changed:
- NFSClient type: {host, read_only, async, root_squash, subtree_check, advanced}
- NFSExport.Clients is now []NFSClient (was []string)
- export-level flags (ro/async/root_squash/subtree_check/advanced) are
  preserved as template defaults for newly added hosts in the UI.
- buildExportLine generates: path host1(ro,sync,...) host2(rw,async,...) fsid=N
- ValidateNFSClient: strict IPv4/CIDR only (0-255 octets, /0-32 prefix)
- parseExportLine now parses per-host options from /etc/exports (previously
  only the first host's options were kept, others were discarded)
- UI: per-host rows with toggles (ro/async/root_squash/subtree_check) and
  advanced options (all_squash, secure, wdelay, hide, crossmnt)

internal/modules/nfs/nfs.go

@@ -30,13 +30,8 @@ type Module struct {
 	cfg Config
 }
 
-type templateExport struct {
-	Path       string
-	ClientSpec string
-}
-
 type templateData struct {
-	Exports []templateExport
+	Lines []string
 }
 
 func New(cfg Config) *Module {
@@ -87,7 +82,7 @@ func (m *Module) Apply(ctx context.Context, database *db.DB) error {
 	return database.ClearDirty(ModuleName)
 }
 
-func buildFlags(e db.NFSExport) string {
+func buildExportFlags(e db.NFSExport) string {
 	parts := make([]string, 0, 8)
 	if e.ReadOnly {
 		parts = append(parts, "ro")
@@ -99,16 +94,16 @@ func buildFlags(e db.NFSExport) string {
 	} else {
 		parts = append(parts, "sync")
 	}
-	if e.SubtreeCheck {
-		parts = append(parts, "subtree_check")
-	} else {
-		parts = append(parts, "no_subtree_check")
-	}
 	if e.RootSquash {
 		parts = append(parts, "root_squash")
 	} else {
 		parts = append(parts, "no_root_squash")
 	}
+	if e.SubtreeCheck {
+		parts = append(parts, "subtree_check")
+	} else {
+		parts = append(parts, "no_subtree_check")
+	}
 	if e.Advanced != "" && e.Advanced != "{}" {
 		var adv db.NFSAdvanced
 		if err := json.Unmarshal([]byte(e.Advanced), &adv); err == nil {
@@ -137,27 +132,77 @@ func buildFlags(e db.NFSExport) string {
 			}
 		}
 	}
-	parts = append(parts, fmt.Sprintf("fsid=%d", e.FSID))
 	return strings.Join(parts, ",")
 }
 
-func clientSpec(clients []string, e db.NFSExport) string {
-	opts := buildFlags(e)
-	if len(clients) == 0 {
-		return fmt.Sprintf("*(%s)", opts)
+func buildExportSuffix(e db.NFSExport) string {
+	return fmt.Sprintf("fsid=%d", e.FSID)
+}
+
+func clientFlags(c db.NFSClient) string {
+	parts := make([]string, 0, 8)
+	if c.ReadOnly {
+		parts = append(parts, "ro")
+	} else {
+		parts = append(parts, "rw")
 	}
-	specs := make([]string, 0, len(clients))
-	for _, client := range clients {
-		client = strings.TrimSpace(client)
-		if client == "" {
+	if c.Async {
+		parts = append(parts, "async")
+	} else {
+		parts = append(parts, "sync")
+	}
+	if c.RootSquash {
+		parts = append(parts, "root_squash")
+	} else {
+		parts = append(parts, "no_root_squash")
+	}
+	if c.SubtreeCheck {
+		parts = append(parts, "subtree_check")
+	} else {
+		parts = append(parts, "no_subtree_check")
+	}
+	if c.Advanced.AllSquash {
+		parts = append(parts, "all_squash")
+	} else {
+		parts = append(parts, "no_all_squash")
+	}
+	if c.Advanced.Secure {
+		parts = append(parts, "secure")
+	} else {
+		parts = append(parts, "insecure")
+	}
+	if c.Advanced.WDelay {
+		parts = append(parts, "wdelay")
+	} else {
+		parts = append(parts, "no_wdelay")
+	}
+	if c.Advanced.Hide {
+		parts = append(parts, "hide")
+	} else {
+		parts = append(parts, "nohide")
+	}
+	if c.Advanced.Crossmnt {
+		parts = append(parts, "crossmnt")
+	}
+	return strings.Join(parts, ",")
+}
+
+func buildExportLine(e db.NFSExport) string {
+	if len(e.Clients) == 0 {
+		return fmt.Sprintf("%s *(%s) %s", e.Path, buildExportFlags(e), buildExportSuffix(e))
+	}
+	specs := make([]string, 0, len(e.Clients))
+	for _, c := range e.Clients {
+		c.Host = strings.TrimSpace(c.Host)
+		if c.Host == "" {
 			continue
 		}
-		specs = append(specs, fmt.Sprintf("%s(%s)", client, opts))
+		specs = append(specs, fmt.Sprintf("%s(%s)", c.Host, clientFlags(c)))
 	}
 	if len(specs) == 0 {
-		return fmt.Sprintf("*(%s)", opts)
+		return fmt.Sprintf("%s *(%s) %s", e.Path, buildExportFlags(e), buildExportSuffix(e))
 	}
-	return strings.Join(specs, " ")
+	return fmt.Sprintf("%s %s %s", e.Path, strings.Join(specs, " "), buildExportSuffix(e))
 }
 
 func (m *Module) renderConfig(exports []db.NFSExport) ([]byte, error) {
@@ -171,12 +216,9 @@ func (m *Module) renderConfig(exports []db.NFSExport) ([]byte, error) {
 		return nil, fmt.Errorf("parse exports template: %w", err)
 	}
 
-	data := templateData{Exports: make([]templateExport, 0, len(exports))}
+	data := templateData{Lines: make([]string, 0, len(exports))}
 	for _, export := range exports {
-		data.Exports = append(data.Exports, templateExport{
-			Path:       export.Path,
-			ClientSpec: clientSpec(export.Clients, export),
-		})
+		data.Lines = append(data.Lines, buildExportLine(export))
 	}
 
 	var buf bytes.Buffer