Fix vpn-data-mount's guest-mount errno 79 bug, add per-share SMB accounts,

host naming, and chain-in from filebrowser/audiobookshelf/emby

Reported live: "mount error(79): Can not access a needed shared library"
on the local CIFS mount step. That message is misleadingly worded — errno
79 is ENOKEY, not a real missing-library problem, and a plain `guest`
mount with no explicit `sec=` hitting it against a real Samba server is a
known cifs-utils/kernel-cifs rough edge in the anonymous-session keyring
path. Fixed as a side effect of switching away from guest access per
direct request (real per-share Samba accounts, not root/guest, matching
"user accounts for data directories"): each mount now gets a dedicated
Samba account (reusing the SSH username — that Unix account already
exists on the home box) with a generated password, remotely provisioned
via smbpasswd over the same SSH trust, and mounted locally via a
root-only credentials file (same convention tools/mount-network-drive.sh
already uses) plus an explicit sec=ntlmssp instead of guest.

Host naming: entering a raw IP now offers to name it in /etc/hosts, then
uses that name for everything from then on (SSH commands, the CIFS mount
address, and re-runs against the same IP). Deliberately /etc/hosts, not
~/.ssh/config — an SSH Host alias only helps the `ssh` command resolve a
name, mount.cifs never consults ~/.ssh/config at all, so an alias alone
wouldn't get the actual mount using a name. Still offers to also add a
matching SSH Host alias on top (pure convenience — skips typing the
username for interactive ssh use) when services/ssh-config.sh's helpers
are available.

Chain-in: filebrowser/audiobookshelf/emby now offer to run
vpn-data-mount first if their data is on a home box that isn't mounted
yet, and default their own directory prompt to whatever was just mounted
(VDM_LAST_MOUNT_POINT, explicitly unset before each chain call so an
unrelated earlier vpn-data-mount run in the same setup.sh session can't
leak its mount point in as a stale default).

services/filebrowser.sh

@@ -277,8 +277,20 @@ install_filebrowser() {
     ensure_docker_dir_ownership "$FB_DIR"
     cd "$FB_DIR" || return 1
 
-    local FB_PATH=""
-    prompt_text "Primary files directory to browse [default: $ACTUAL_HOME]:" "$ACTUAL_HOME" FB_PATH
+    # Reset before the chain call, not after — VDM_LAST_MOUNT_POINT is a
+    # plain global set by services/vpn-data-mount.sh, so without this an
+    # unrelated earlier vpn-data-mount run in the same setup.sh session
+    # would silently leak its mount point in here as the default even if
+    # the user declines below or this chain never runs at all.
+    unset VDM_LAST_MOUNT_POINT
+    if declare -F install_vpn-data-mount >/dev/null 2>&1; then
+        local USE_VPN_DATA=""
+        prompt_yn "Is the data you want to browse on a VPN-connected home box that isn't mounted yet? (y/n):" "n" USE_VPN_DATA
+        [[ "$USE_VPN_DATA" =~ ^[Yy]$ ]] && install_vpn-data-mount
+    fi
+
+    local FB_PATH="" _default_fb_path="${VDM_LAST_MOUNT_POINT:-$ACTUAL_HOME}"
+    prompt_text "Primary files directory to browse [default: $_default_fb_path]:" "$_default_fb_path" FB_PATH
 
     # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
     # explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,