feat: structured NFS options with auto-fsid and manual watched mounts

NFS exports: replace plain-text options string with typed booleans
(read_only, async, root_squash, subtree_check) + advanced JSON blob.
fsid is auto-generated via crypto/rand with collision retry and is
never user-settable. Breaking API change (options field removed).

Dashboard: filter disks to manual+samba+nfs sources only; no more
auto-discovery of all /proc/mounts entries.

Settings: new 'Puntos de montaje vigilados' card with add/remove
for manual mount points. AllowedRoots validation applied.

Version bump: 0.1.10 -> 0.2.0

internal/web/handlers_system.go

@@ -1,13 +1,14 @@
 package web
 
 import (
-	"bufio"
+	"encoding/json"
 	"net/http"
-	"os"
 	"sort"
 	"strings"
 	"syscall"
 
+	"github.com/go-chi/chi/v5"
+
 	"github.com/darroyo/nasctl/internal/system"
 )
 
@@ -47,8 +48,6 @@ func (s *Server) handleVersion(w http.ResponseWriter, r *http.Request) {
 func (s *Server) collectDiskUsage() []diskUsage {
 	entries := make(map[string]*diskUsage)
 
-	entries["/"] = &diskUsage{Path: "/", Source: "system", Available: true}
-
 	shares, err := s.DB.ListSambaShares()
 	if err == nil {
 		for _, share := range shares {
@@ -74,7 +73,15 @@ func (s *Server) collectDiskUsage() []diskUsage {
 		}
 	}
 
-	readProcMounts(entries)
+	watched, err := s.DB.ListWatchedMounts()
+	if err == nil {
+		for _, m := range watched {
+			key := m.Path
+			if _, ok := entries[key]; !ok {
+				entries[key] = &diskUsage{Path: key, Source: "manual", Available: true}
+			}
+		}
+	}
 
 	var result []diskUsage
 	for _, e := range entries {
@@ -92,26 +99,6 @@ func (s *Server) collectDiskUsage() []diskUsage {
 	return result
 }
 
-func readProcMounts(entries map[string]*diskUsage) {
-	f, err := os.Open("/proc/mounts")
-	if err != nil {
-		return
-	}
-	defer f.Close()
-
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		fields := strings.Fields(scanner.Text())
-		if len(fields) < 3 {
-			continue
-		}
-		mountPoint := fields[1]
-		if _, ok := entries[mountPoint]; !ok {
-			entries[mountPoint] = &diskUsage{Path: mountPoint, Source: "mount", Available: true}
-		}
-	}
-}
-
 func fillDiskUsage(e *diskUsage) {
 	var stat syscall.Statfs_t
 	if err := syscall.Statfs(e.Path, &stat); err != nil {
@@ -145,3 +132,55 @@ func (s *Server) collectServiceStatus(r *http.Request) []serviceStatus {
 	}
 	return statuses
 }
+
+func (s *Server) handleListWatchedMounts(w http.ResponseWriter, r *http.Request) {
+	mounts, err := s.DB.ListWatchedMounts()
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"mounts": mounts})
+}
+
+func (s *Server) handleCreateWatchedMount(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Path string `json:"path"`
+	}
+	defer r.Body.Close()
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	if err := system.ValidatePathAllowed(req.Path, s.AllowedRoots); err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	exists, err := s.DB.WatchedMountPathExists(req.Path)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	if exists {
+		writeError(w, http.StatusConflict, "path already watched")
+		return
+	}
+	mount, err := s.DB.CreateWatchedMount(req.Path)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusCreated, mount)
+}
+
+func (s *Server) handleDeleteWatchedMount(w http.ResponseWriter, r *http.Request) {
+	id, err := parseID(chi.URLParam(r, "id"))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid id")
+		return
+	}
+	if err := s.DB.DeleteWatchedMount(id); err != nil {
+		writeError(w, http.StatusNotFound, err.Error())
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}