Add samba service: shares, dedicated users, LAN-scoped firewall

New services/samba.sh, following the non-Docker service shape
(services/crowdsec.sh) since Samba runs natively (smbd/nmbd), not in
a container:

- Installs the samba package if missing
- Prompts to add one or more shares (path, guest vs. authenticated)
- For authenticated shares, creates a system Linux account (if one
  doesn't already exist) and a separate Samba password via smbpasswd
  for each user, adds them to a sambashare group
- Appends share stanzas to /etc/samba/smb.conf (tagged with a
  # ubuntu-post-install:share:<name> marker for later discovery),
  validates with testparm before restarting smbd/nmbd
- Opens UFW for SMB (137/138 udp, 139/445 tcp), scoped to the
  detected LAN subnet by default rather than the whole internet
- Writes a docs-only README under ~/docker/samba (no compose stack)

Registered under `utilities`, with an is_installed()/install_count()
entry in setup.sh (command -v smbd, matching the glow/crowdsec
pattern for non-Docker services) and a README.md Services table entry.

Also wired as an optional nudge into services/base.sh, alongside the
existing Caddy/CrowdSec/NetBird prompts — offered during the base
install but not unconditional, since (unlike net-tools/ncdu) it needs
real input — a share path and at least one user — to do anything
useful, so it defaults to declined rather than accepted.

setup.sh

@@ -121,6 +121,7 @@ is_installed() {
         base) command -v ncdu >/dev/null 2>&1 ;;
         glow) command -v glow >/dev/null 2>&1 ;;
         crowdsec) command -v cscli >/dev/null 2>&1 ;;
+        samba) command -v smbd >/dev/null 2>&1 ;;
         security-dashboard) [ -f /opt/security-dashboard/app.py ] ;;
         kdeconnect) command -v kdeconnect >/dev/null 2>&1 ;;
         silent-send) [ -d "$ACTUAL_HOME/silent-send/.git" ] ;;
@@ -156,7 +157,7 @@ is_installed() {
 # is_installed() as 0 or 1.
 install_count() {
     case "$1" in
-        base|glow|crowdsec|security-dashboard|kdeconnect|silent-send|sync-cc|claude-cli|sky-cam|sky-cam-frigate|asterisk|pstn-trunk|sms-inbound|ssh-config|ssh-key-import)
+        base|glow|crowdsec|samba|security-dashboard|kdeconnect|silent-send|sync-cc|claude-cli|sky-cam|sky-cam-frigate|asterisk|pstn-trunk|sms-inbound|ssh-config|ssh-key-import)
             is_installed "$1" && echo 1 || echo 0 ;;
         wordpress)
             find "$DOCKER_DIR" -mindepth 1 -maxdepth 1 -name 'wordpress-*' -type d 2>/dev/null | wc -l ;;