feat(nfs): per-host NFS options (IP/CIDR with own ro/async/squash flags)

This is a backward-compatible MINOR bump (0.4.0 → 0.5.0).

BREAKING NOTES (for users upgrading from pre-0.5.0):
- The nfs_exports.clients column schema changed from []string to
  []NFSClient (per-host options). A migration (0005) transforms existing
  string arrays into object arrays, taking export-level options as
  defaults for each host.
- ValidateNFSClient now only accepts IPv4 (192.168.1.1) or IPv4/CIDR
  (192.168.1.0/24). Hostnames, wildcards, netgroups are rejected.
- If you use NASCTL_IMPORT_ON_BOOT, re-import your /etc/exports to pick
  up per-host options.

What changed:
- NFSClient type: {host, read_only, async, root_squash, subtree_check, advanced}
- NFSExport.Clients is now []NFSClient (was []string)
- export-level flags (ro/async/root_squash/subtree_check/advanced) are
  preserved as template defaults for newly added hosts in the UI.
- buildExportLine generates: path host1(ro,sync,...) host2(rw,async,...) fsid=N
- ValidateNFSClient: strict IPv4/CIDR only (0-255 octets, /0-32 prefix)
- parseExportLine now parses per-host options from /etc/exports (previously
  only the first host's options were kept, others were discarded)
- UI: per-host rows with toggles (ro/async/root_squash/subtree_check) and
  advanced options (all_squash, secure, wdelay, hide, crossmnt)

internal/modules/nfs/nfs_test.go

@@ -0,0 +1,108 @@
+package nfs
+
+import (
+	"testing"
+
+	"github.com/darroyo/nasctl/internal/db"
+)
+
+func TestBuildExportLine(t *testing.T) {
+	tests := []struct {
+		name  string
+		exp   db.NFSExport
+		lines []string
+	}{
+		{
+			name: "single host with options",
+			exp: db.NFSExport{
+				Path:         "/srv/nfs/shared",
+				Clients:      []db.NFSClient{{Host: "192.168.1.100", ReadOnly: false, Async: false, RootSquash: true, SubtreeCheck: false}},
+				ReadOnly:     false,
+				Async:        false,
+				RootSquash:   true,
+				SubtreeCheck: false,
+				FSID:         1,
+				Advanced:     "{}",
+			},
+			lines: []string{`/srv/nfs/shared 192.168.1.100(rw,sync,root_squash,no_subtree_check,no_all_squash,insecure,no_wdelay,nohide) fsid=1`},
+		},
+		{
+			name: "multiple hosts different options",
+			exp: db.NFSExport{
+				Path: "/srv/nfs/shared",
+				Clients: []db.NFSClient{
+					{Host: "192.168.1.0/24", ReadOnly: false, Async: false, RootSquash: true, SubtreeCheck: false, Advanced: db.NFSAdvanced{Crossmnt: true}},
+					{Host: "10.0.0.5", ReadOnly: true, Async: true, RootSquash: false, SubtreeCheck: false},
+				},
+				ReadOnly:     false,
+				Async:        false,
+				RootSquash:   true,
+				SubtreeCheck: false,
+				FSID:         2,
+				Advanced:     "{}",
+			},
+			lines: []string{
+				`/srv/nfs/shared 192.168.1.0/24(rw,sync,root_squash,no_subtree_check,no_all_squash,insecure,no_wdelay,nohide,crossmnt) 10.0.0.5(ro,async,no_root_squash,no_subtree_check,no_all_squash,insecure,no_wdelay,nohide) fsid=2`,
+			},
+		},
+		{
+			name: "no clients fallback wildcard",
+			exp: db.NFSExport{
+				Path:         "/srv/nfs/public",
+				Clients:      []db.NFSClient{},
+				ReadOnly:     true,
+				Async:        false,
+				RootSquash:   true,
+				SubtreeCheck: false,
+				FSID:         3,
+				Advanced:     "{}",
+			},
+			lines: []string{`/srv/nfs/public *(ro,sync,root_squash,no_subtree_check) fsid=3`},
+		},
+		{
+			name: "advanced options per host",
+			exp: db.NFSExport{
+				Path: "/srv/nfs/secure",
+				Clients: []db.NFSClient{
+					{Host: "192.168.1.0/24", ReadOnly: false, Async: false, RootSquash: true, SubtreeCheck: false, Advanced: db.NFSAdvanced{AllSquash: true, Secure: true, WDelay: true, Hide: true, Crossmnt: true}},
+				},
+				ReadOnly:     false,
+				Async:        false,
+				RootSquash:   true,
+				SubtreeCheck: false,
+				FSID:         4,
+				Advanced:     "{}",
+			},
+			lines: []string{
+				`/srv/nfs/secure 192.168.1.0/24(rw,sync,root_squash,no_subtree_check,all_squash,secure,wdelay,hide,crossmnt) fsid=4`,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			line := buildExportLine(tt.exp)
+			if len(tt.lines) != 1 {
+				t.Fatalf("expected 1 line, got test setup error")
+			}
+			if line != tt.lines[0] {
+				t.Errorf("buildExportLine() = %q, want %q", line, tt.lines[0])
+			}
+		})
+	}
+}
+
+func TestClientFlags(t *testing.T) {
+	c := db.NFSClient{
+		Host:         "192.168.1.0/24",
+		ReadOnly:     true,
+		Async:        true,
+		RootSquash:   false,
+		SubtreeCheck: true,
+		Advanced:     db.NFSAdvanced{AllSquash: true, Secure: true},
+	}
+	flags := clientFlags(c)
+	if flags != "ro,async,no_root_squash,subtree_check,all_squash,secure,no_wdelay,nohide" {
+		t.Errorf("clientFlags() = %q, unexpected flags", flags)
+	}
+}