SMB: optional legacy mode (SMB1 + NTLMv1) for old clients

Supermicro BMC virtual media ("CD-ROM image" over a Windows share) only
offers the SMB1 dialect "NT LM 0.12", which Samba rejects with
server min protocol = SMB2. Add an opt-in "Allow legacy clients" SMB
setting that renders server min protocol = NT1 and
ntlm auth = ntlmv1-permitted. Off by default.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/shares/shares_test.go

@@ -46,6 +46,13 @@ func TestRenderSMB(t *testing.T) {
 	if out := RenderSMB(c, "ansible"); !strings.Contains(out, "map to guest = Never") || strings.Contains(out, "Bad User") {
 		t.Errorf("user-only config must not map to guest:\n%s", out)
 	}
+	if out := RenderSMB(c, "ansible"); strings.Contains(out, "NT1") || strings.Contains(out, "ntlmv1") {
+		t.Errorf("SMB1 enabled without the legacy flag")
+	}
+	c.SMB.Legacy = true
+	if out := RenderSMB(c, "ansible"); !strings.Contains(out, "\n   server min protocol = NT1\n   ntlm auth = ntlmv1-permitted\n") || strings.Contains(out, "SMB2") {
+		t.Errorf("legacy mode:\n%s", out)
+	}
 }
 
 func TestRenderExports(t *testing.T) {