v0.4.67: NFSv3 alongside SMB (in-process via nfs3_client crate)

NFS is back — done right this time. v0.4.67 ships a pure-Rust NFSv3
client (`nfs3_client` 0.9 from the xetdata/Vaiz crate family) running
in-process inside the openpxe binary. No `mount.nfs`, no kernel
modules, no `CAP_SYS_ADMIN`, no subprocess. Works in every container
that the v0.4.65 SMB path works in (Unraid included).

The v0.4.65 SMB path stays as-is. Operators get both protocols
side-by-side and pick whichever their NAS prefers — or use both
together. NFSv3 has one architectural advantage over the SMB
userspace path: HTTP Range requests work for NFS-sourced ISOs
because NFSv3 READ3 takes an explicit offset. SMB-sourced ISOs still
return 416 for ranges (smbclient CLI can't seek mid-stream).

## What's new

- `crates/iso-store/src/nfs_share.rs` — `NfsShareManager` mirroring
  `SmbShareManager` structurally. Lists ISOs via READDIR3+LOOKUP3+
  GETATTR3, streams files via READ3 in 64 KiB chunks piped to axum
  body streams. Uses `connect_from_privileged_port(false)` because
  the openpxe binary runs as uid 10001 — most modern NFS servers
  allow that; a server that demands privileged ports needs
  `insecure` in /etc/exports, and the hint translation calls that
  out specifically.
- `IsoSource::Nfs { share_id, relative_path }` variant alongside the
  existing `Smb`. `IsoStore::iso_path_for` returns None for both;
  the HTTP handler dispatches to the right share manager.
- `/api/nfs-shares` CRUD + scan endpoints, parallel to
  `/api/smb-shares`. `POST` body: `{ server, export, port? }`.
- `nfs` terminal command back (this time as in-process, not kernel
  mount): `list | add <srv>:<export> [port] | remove | scan`. The
  v0.4.64 `nfs` command name pointing at kernel mount is moot
  history — same name, completely different mechanism.
- Storage tab: a new NFS shares card sits directly below the SMB
  shares card. The form is simpler (no auth fields) since NFSv3
  uses AUTH_SYS and access is gated server-side by client IP.
- Dashboard "Images available" tile sums SMB + NFS reachable shares
  into a generic "N remote shares" line.

## What's the same

- The structured `{error, stderr, hint}` JSON shape on failures
  matches the SMB API exactly, so the UI's error banner renders
  identically.
- Hint translation: NFS3ERR_ACCES → "exports list", NFS3ERR_NOENT →
  "export path doesn't exist", `mount denied` → "/etc/exports may
  need `insecure`", timeouts → "check IP/port/firewall".
- Persistence: `<work_dir>/nfs_shares.json`. No conflict with the
  long-dead v0.4.64 `nfs.json`.

## Why nfs3_client

User picked it: pure-Rust matches the architecture, NFSv3 covers the
real-world cases, AUTH_SYS keeps the UI simple. The crate is at
0.9.0, MIT/Unlicense, rust-version 1.88 (we're on 1.95). Tokio
feature flag enabled. Image size unchanged at compile time — single
musl static binary, no extra OS packages.

## Tests

160 passing (was 150 in v0.4.66, +10):
- nfs_share parser: stable share ids, server normalization (smb://,
  cifs://, \\, // all stripped).
- hint_for(): NFS3ERR_ACCES, NFS3ERR_NOENT, mount denied, unknown.
- status_label() covers the common nfsstat3 codes.
- HTTP integration: nfs-shares list starts empty, missing server
  rejected, export without leading slash rejected.

`cargo clippy --workspace --all-targets -- -D warnings` clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

crates/http-api/tests/full_flow.rs

@@ -14,7 +14,7 @@ use axum::body::Body;
 use axum::http::{header, Request, StatusCode};
 use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
 use openpxe_http_api::{build_router, AppState};
-use openpxe_iso_store::{IsoStore, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbShareManager};
 use tempfile::tempdir;
 use tower::ServiceExt;
 
@@ -95,6 +95,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(dir.path());
     let smb_shares = SmbShareManager::new(dir.path(), iso_store.clone());
+    let nfs_shares = NfsShareManager::new(dir.path(), iso_store.clone());
     let log_bus = LogBus::new(64);
     let hosts = HostBindings::load_or_default(dir.path());
     let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
@@ -117,6 +118,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         metrics,
         smb: None,
         smb_shares,
+        nfs_shares,
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus,
         started_at: time::OffsetDateTime::now_utc(),
@@ -531,6 +533,54 @@ async fn smb_shares_list_starts_empty() {
     assert_eq!(v["shares"].as_array().unwrap().len(), 0);
 }
 
+// v0.4.67: NFSv3 share manager (parallel to SMB).
+
+#[tokio::test]
+async fn nfs_shares_list_starts_empty() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, b) = get(&app, "/api/nfs-shares").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
+    assert_eq!(v["shares"].as_array().unwrap().len(), 0);
+}
+
+#[tokio::test]
+async fn nfs_shares_add_rejects_missing_server() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, b) = post_json(
+        &app,
+        "/api/nfs-shares",
+        r#"{"server":"","export":"/srv/isos"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let msg = String::from_utf8_lossy(&b);
+    assert!(
+        msg.to_lowercase().contains("server"),
+        "expected server hint, got: {msg}"
+    );
+}
+
+#[tokio::test]
+async fn nfs_shares_add_rejects_export_without_leading_slash() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, b) = post_json(
+        &app,
+        "/api/nfs-shares",
+        r#"{"server":"10.0.0.5","export":"srv/isos"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let msg = String::from_utf8_lossy(&b);
+    assert!(
+        msg.to_lowercase().contains("export"),
+        "expected export-path hint, got: {msg}"
+    );
+}
+
 #[tokio::test]
 async fn terminal_help_and_status_round_trip() {
     let (state, _dir) = build_state().await;