Add samba service: shares, dedicated users, LAN-scoped firewall

New services/samba.sh, following the non-Docker service shape
(services/crowdsec.sh) since Samba runs natively (smbd/nmbd), not in
a container:

- Installs the samba package if missing
- Prompts to add one or more shares (path, guest vs. authenticated)
- For authenticated shares, creates a system Linux account (if one
  doesn't already exist) and a separate Samba password via smbpasswd
  for each user, adds them to a sambashare group
- Appends share stanzas to /etc/samba/smb.conf (tagged with a
  # ubuntu-post-install:share:<name> marker for later discovery),
  validates with testparm before restarting smbd/nmbd
- Opens UFW for SMB (137/138 udp, 139/445 tcp), scoped to the
  detected LAN subnet by default rather than the whole internet
- Writes a docs-only README under ~/docker/samba (no compose stack)

Registered under `utilities`, with an is_installed()/install_count()
entry in setup.sh (command -v smbd, matching the glow/crowdsec
pattern for non-Docker services) and a README.md Services table entry.

Also wired as an optional nudge into services/base.sh, alongside the
existing Caddy/CrowdSec/NetBird prompts — offered during the base
install but not unconditional, since (unlike net-tools/ncdu) it needs
real input — a share path and at least one user — to do anything
useful, so it defaults to declined rather than accepted.

services/base.sh

@@ -21,6 +21,7 @@ install_base() {
         echo "[DRY-RUN] Would offer to mount SMB data from a NetBird-connected home box (if NetBird is present)"
         echo "[DRY-RUN] Would offer Caddy reverse proxy install (full repo only)"
         echo "[DRY-RUN] Would offer CrowdSec intrusion prevention install (full repo only)"
+        echo "[DRY-RUN] Would offer Samba (SMB/CIFS) file sharing install (full repo only)"
         echo "[DRY-RUN] Would offer to add SSH Host aliases to ~/.ssh/config"
         return 0
     fi
@@ -80,6 +81,14 @@ install_base() {
     _base_setup_crowdsec
     cd "$_BASE_PWD" 2>/dev/null || true
 
+    # ── Samba ────────────────────────────────────────────────────────────────
+    # Same nudge-not-mandatory shape as Caddy/CrowdSec above: fully optional,
+    # independently re-runnable later via `sudo ./setup.sh samba`. Defaults to
+    # n (unlike Caddy/CrowdSec) because it needs real input to be useful — a
+    # share path and at least one user — not just "yes, with sane defaults".
+    _base_setup_samba
+    cd "$_BASE_PWD" 2>/dev/null || true
+
     # ── SSH Host aliases ─────────────────────────────────────────────────────
     _base_setup_ssh_aliases
 
@@ -329,6 +338,22 @@ _base_setup_crowdsec() {
     install_crowdsec
 }
 
+_base_setup_samba() {
+    if command -v smbd &>/dev/null; then
+        log_info "Samba already installed."
+        return 0
+    fi
+    # Only available when the full repo is sourced (setup.sh loads every
+    # services/*.sh up front) — a standalone copy of base.sh doesn't have
+    # install_samba, so skip silently rather than error.
+    declare -F install_samba &>/dev/null || return 0
+
+    local INSTALL_SAMBA=""
+    prompt_yn "Install Samba (SMB/CIFS) file sharing now — shares, users, passwords? (y/n):" "n" INSTALL_SAMBA
+    [[ "$INSTALL_SAMBA" =~ ^[Yy]$ ]] || return 0
+    install_samba
+}
+
 _base_setup_ssh_aliases() {
     local ADD_ALIAS=""
     prompt_yn "Add an SSH Host alias now ('ssh myserver' instead of 'ssh user@1.2.3.4')? (y/n):" "n" ADD_ALIAS