SMB: map to guest = Never when no share allows guests

With "Bad User" an unknown account (the Windows login) silently became a
guest session; Windows 10/11 refuse guest sessions and report "network
path not found" instead of asking for a password, so password-only shares
were unreachable from Explorer. Map to guest only while a guest share
exists, and document the net use workaround on the shares page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/shares/render.go

@@ -15,18 +15,34 @@ func yesno(b bool) string {
 	return "no"
 }
 
+func anyGuest(c Config) bool {
+	for _, s := range c.SMB.Shares {
+		if s.Guest {
+			return true
+		}
+	}
+	return false
+}
+
 // RenderSMB produces the complete smb.conf. owner is the Unix account every
 // SMB session acts as (force user), so files end up with the same owner the
 // containers use.
 func RenderSMB(c Config, owner string) string {
 	var b strings.Builder
 	fmt.Fprintf(&b, "%s\n\n[global]\n", Header)
+	// Bad User turns unknown accounts (e.g. the Windows login) into guests.
+	// Without guest shares that only yields a guest session Windows refuses
+	// with a misleading "network path not found" instead of a password prompt.
+	mapGuest := "Never"
+	if anyGuest(c) {
+		mapGuest = "Bad User"
+	}
 	g := []string{
 		"workgroup = " + c.SMB.Workgroup,
 		"server string = " + c.SMB.ServerString,
 		"server role = standalone server",
 		"security = user",
-		"map to guest = Bad User",
+		"map to guest = " + mapGuest,
 		"guest account = nobody",
 		"server min protocol = SMB2",
 		"unix charset = UTF-8",

internal/shares/shares_test.go

@@ -40,6 +40,12 @@ func TestRenderSMB(t *testing.T) {
 	if strings.Count(out, "\n   veto files = ") != 1 {
 		t.Errorf("veto files only where requested")
 	}
+	// without guest shares unknown users are rejected, so Windows asks for a password
+	c := sample()
+	c.SMB.Shares = c.SMB.Shares[1:]
+	if out := RenderSMB(c, "ansible"); !strings.Contains(out, "map to guest = Never") || strings.Contains(out, "Bad User") {
+		t.Errorf("user-only config must not map to guest:\n%s", out)
+	}
 }
 
 func TestRenderExports(t *testing.T) {