SMB: map to guest = Never when no share allows guests

With "Bad User" an unknown account (the Windows login) silently became a
guest session; Windows 10/11 refuse guest sessions and report "network
path not found" instead of asking for a password, so password-only shares
were unreachable from Explorer. Map to guest only while a guest share
exists, and document the net use workaround on the shares page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/shares/shares_test.go

@@ -40,6 +40,12 @@ func TestRenderSMB(t *testing.T) {
 	if strings.Count(out, "\n   veto files = ") != 1 {
 		t.Errorf("veto files only where requested")
 	}
+	// without guest shares unknown users are rejected, so Windows asks for a password
+	c := sample()
+	c.SMB.Shares = c.SMB.Shares[1:]
+	if out := RenderSMB(c, "ansible"); !strings.Contains(out, "map to guest = Never") || strings.Contains(out, "Bad User") {
+		t.Errorf("user-only config must not map to guest:\n%s", out)
+	}
 }
 
 func TestRenderExports(t *testing.T) {