feat: structured NFS options with auto-fsid and manual watched mounts

NFS exports: replace plain-text options string with typed booleans
(read_only, async, root_squash, subtree_check) + advanced JSON blob.
fsid is auto-generated via crypto/rand with collision retry and is
never user-settable. Breaking API change (options field removed).

Dashboard: filter disks to manual+samba+nfs sources only; no more
auto-discovery of all /proc/mounts entries.

Settings: new 'Puntos de montaje vigilados' card with add/remove
for manual mount points. AllowedRoots validation applied.

Version bump: 0.1.10 -> 0.2.0

internal/db/queries_watched.go

@@ -0,0 +1,87 @@
+package db
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func scanWatchedMount(row interface {
+	Scan(dest ...any) error
+}) (WatchedMount, error) {
+	var m WatchedMount
+	var createdAt string
+	if err := row.Scan(&m.ID, &m.Path, &createdAt); err != nil {
+		return WatchedMount{}, err
+	}
+	m.CreatedAt = parseTime(createdAt)
+	return m, nil
+}
+
+func (d *DB) ListWatchedMounts() ([]WatchedMount, error) {
+	rows, err := d.conn.Query(`SELECT id, path, created_at FROM watched_mounts ORDER BY path ASC`)
+	if err != nil {
+		return nil, fmt.Errorf("list watched mounts: %w", err)
+	}
+	defer rows.Close()
+
+	var mounts []WatchedMount
+	for rows.Next() {
+		m, err := scanWatchedMount(rows)
+		if err != nil {
+			return nil, fmt.Errorf("scan watched mount: %w", err)
+		}
+		mounts = append(mounts, m)
+	}
+	return mounts, rows.Err()
+}
+
+func (d *DB) GetWatchedMount(id int64) (WatchedMount, error) {
+	row := d.conn.QueryRow(`SELECT id, path, created_at FROM watched_mounts WHERE id = ?`, id)
+	m, err := scanWatchedMount(row)
+	if err == sql.ErrNoRows {
+		return WatchedMount{}, fmt.Errorf("watched mount not found")
+	}
+	if err != nil {
+		return WatchedMount{}, fmt.Errorf("get watched mount: %w", err)
+	}
+	return m, nil
+}
+
+func (d *DB) CreateWatchedMount(path string) (WatchedMount, error) {
+	result, err := d.conn.Exec(
+		`INSERT INTO watched_mounts (path) VALUES (?)`,
+		path,
+	)
+	if err != nil {
+		return WatchedMount{}, fmt.Errorf("create watched mount: %w", err)
+	}
+	id, err := result.LastInsertId()
+	if err != nil {
+		return WatchedMount{}, fmt.Errorf("last insert id: %w", err)
+	}
+	return d.GetWatchedMount(id)
+}
+
+func (d *DB) DeleteWatchedMount(id int64) error {
+	result, err := d.conn.Exec(`DELETE FROM watched_mounts WHERE id = ?`, id)
+	if err != nil {
+		return fmt.Errorf("delete watched mount: %w", err)
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if rows == 0 {
+		return fmt.Errorf("watched mount not found")
+	}
+	return nil
+}
+
+func (d *DB) WatchedMountPathExists(path string) (bool, error) {
+	var count int
+	err := d.conn.QueryRow(`SELECT COUNT(1) FROM watched_mounts WHERE path = ?`, path).Scan(&count)
+	if err != nil {
+		return false, err
+	}
+	return count > 0, nil
+}