nfs4.1: version negotiation + config + daemon wiring + v3 regression gate

[hartsock]

Goal

Wire the v4.1 server into the daemon, gate it on config, make version negotiation
honest, and lock in "NFSv3 never regresses".

Scope

• Config: nfs.v4_enabled / nfs.v41_enabled (default false); the embedded
  server advertises only enabled versions.
• The protocols/nfs/services REST state (nfs4: REST protocols/nfs surface (services + export-policies + volume nas v4 fields) #53) reflects the actual runtime
  versions (REST flag ⇄ served version stay consistent).
• Single listener serving v3 + (optionally) v4.1 on 2049; clean
  NFS4ERR_MINOR_VERS_MISMATCH for unsupported minorversions.
• Regression gate: with v4 off, behavior is byte-identical to v0.3.x; the
  existing NFSv3 live-fs + reconstitution suites stay green.

Dependencies

#53, #57.

Acceptance

• v3-only config == today; v4.1 config serves both; REST flag and config agree;
  NFSv3 regression suite green.