feat(nfs): per-host NFS options (IP/CIDR with own ro/async/squash flags)

This is a backward-compatible MINOR bump (0.4.0 → 0.5.0).

BREAKING NOTES (for users upgrading from pre-0.5.0):
- The nfs_exports.clients column schema changed from []string to
  []NFSClient (per-host options). A migration (0005) transforms existing
  string arrays into object arrays, taking export-level options as
  defaults for each host.
- ValidateNFSClient now only accepts IPv4 (192.168.1.1) or IPv4/CIDR
  (192.168.1.0/24). Hostnames, wildcards, netgroups are rejected.
- If you use NASCTL_IMPORT_ON_BOOT, re-import your /etc/exports to pick
  up per-host options.

What changed:
- NFSClient type: {host, read_only, async, root_squash, subtree_check, advanced}
- NFSExport.Clients is now []NFSClient (was []string)
- export-level flags (ro/async/root_squash/subtree_check/advanced) are
  preserved as template defaults for newly added hosts in the UI.
- buildExportLine generates: path host1(ro,sync,...) host2(rw,async,...) fsid=N
- ValidateNFSClient: strict IPv4/CIDR only (0-255 octets, /0-32 prefix)
- parseExportLine now parses per-host options from /etc/exports (previously
  only the first host's options were kept, others were discarded)
- UI: per-host rows with toggles (ro/async/root_squash/subtree_check) and
  advanced options (all_squash, secure, wdelay, hide, crossmnt)

internal/web/handlers_nfs.go

@@ -13,16 +13,24 @@ import (
 	"github.com/darroyo/nasctl/internal/system"
 )
 
+type nfsClientRequest struct {
+	Host         string `json:"host"`
+	ReadOnly     bool   `json:"read_only"`
+	Async        bool   `json:"async"`
+	RootSquash   bool   `json:"root_squash"`
+	SubtreeCheck bool   `json:"subtree_check"`
+	Advanced     string `json:"advanced"`
+}
+
 type nfsExportRequest struct {
 	Path    string   `json:"path"`
-	Clients []string `json:"clients"`
-	// Main options
-	ReadOnly     bool `json:"read_only"`
-	Async        bool `json:"async"`
-	RootSquash   bool `json:"root_squash"`
-	SubtreeCheck bool `json:"subtree_check"`
-	// Advanced options stored as JSON string
-	Advanced string `json:"advanced"`
+	Clients []nfsClientRequest `json:"clients"`
+	// Main options (used as template defaults for new hosts)
+	ReadOnly     bool   `json:"read_only"`
+	Async        bool   `json:"async"`
+	RootSquash   bool   `json:"root_squash"`
+	SubtreeCheck bool   `json:"subtree_check"`
+	Advanced     string `json:"advanced"`
 }
 
 func (req nfsExportRequest) validate(allowedRoots []string) error {
@@ -30,7 +38,7 @@ func (req nfsExportRequest) validate(allowedRoots []string) error {
 		return err
 	}
 	for _, client := range req.Clients {
-		if err := system.ValidateNFSClient(client); err != nil {
+		if err := system.ValidateNFSClient(client.Host); err != nil {
 			return err
 		}
 	}
@@ -38,9 +46,20 @@ func (req nfsExportRequest) validate(allowedRoots []string) error {
 }
 
 func (req nfsExportRequest) toModel() db.NFSExport {
+	clients := make([]db.NFSClient, 0, len(req.Clients))
+	for _, c := range req.Clients {
+		clients = append(clients, db.NFSClient{
+			Host:         c.Host,
+			ReadOnly:     c.ReadOnly,
+			Async:        c.Async,
+			RootSquash:   c.RootSquash,
+			SubtreeCheck: c.SubtreeCheck,
+			Advanced:     parseNFSAdvanced(c.Advanced),
+		})
+	}
 	return db.NFSExport{
 		Path:         req.Path,
-		Clients:      req.Clients,
+		Clients:      clients,
 		ReadOnly:     req.ReadOnly,
 		Async:        req.Async,
 		RootSquash:   req.RootSquash,
@@ -49,6 +68,15 @@ func (req nfsExportRequest) toModel() db.NFSExport {
 	}
 }
 
+func parseNFSAdvanced(raw string) db.NFSAdvanced {
+	var adv db.NFSAdvanced
+	if raw == "" || raw == "{}" {
+		return adv
+	}
+	_ = json.Unmarshal([]byte(raw), &adv)
+	return adv
+}
+
 func (s *Server) handleListNFSExports(w http.ResponseWriter, r *http.Request) {
 	exports, err := s.DB.ListNFSExports()
 	if err != nil {