feat: structured NFS options with auto-fsid and manual watched mounts

NFS exports: replace plain-text options string with typed booleans
(read_only, async, root_squash, subtree_check) + advanced JSON blob.
fsid is auto-generated via crypto/rand with collision retry and is
never user-settable. Breaking API change (options field removed).

Dashboard: filter disks to manual+samba+nfs sources only; no more
auto-discovery of all /proc/mounts entries.

Settings: new 'Puntos de montaje vigilados' card with add/remove
for manual mount points. AllowedRoots validation applied.

Version bump: 0.1.10 -> 0.2.0

web/src/api.ts

@@ -48,12 +48,17 @@ export interface DiskUsage {
   free_bytes: number;
   used_bytes: number;
   used_percent: number;
-  source: "system" | "mount" | "samba" | "nfs";
+  source: "system" | "mount" | "samba" | "nfs" | "manual";
   used_by?: string[];
   available: boolean;
   error?: string;
 }
 
+export interface WatchedMount {
+  id: number;
+  path: string;
+}
+
 export interface ServiceStatus {
   name: string;
   active: boolean;
@@ -128,6 +133,11 @@ export const api = {
   createUser: (u: Partial<User> & { password?: string }) => request<User>("POST", "/users/", u),
   updateUser: (id: number, u: Partial<User> & { password?: string }) => request<User>("PUT", `/users/${id}/`, u),
   deleteUser: (id: number) => request<void>("DELETE", `/users/${id}/`),
+
+  // watched mounts
+  listWatchedMounts: () => request<{ mounts: WatchedMount[] }>("GET", "/system/watched-mounts"),
+  createWatchedMount: (path: string) => request<WatchedMount>("POST", "/system/watched-mounts", { path }),
+  deleteWatchedMount: (id: number) => request<void>("DELETE", `/system/watched-mounts/${id}`),
 };
 
 export function formatBytes(bytes: number): string {