cifs: packaging + deploy (Samba in Docker/.deb/.rpm; k8s 445; default keeps CIFS off)

[hartsock]

Goal

Ship Samba in the deploy surfaces, feature-gated, without regressing NFS or the
no-CIFS default.

Scope

• Docker image installs Samba only in a CIFS-enabled variant (or a single
  image where smbd launches only when cifs.enabled); document the size cost.
• .deb/.rpm declare the Samba dependency (or recommend) for the CIFS path.
• k8s: expose 445, the securityContext/caps Samba needs, config wiring; default
  manifests keep CIFS off.
• config.example.toml documents [cifs] + the multiprotocol share model.

Dependencies

#63.

Acceptance

• A CIFS-enabled container/pod serves a share end-to-end; the default (CIFS off)
  image/pod is unchanged from today.