Add remote CIFS/SMB storage sync with session-only credentials

[lamewarden]

Adds a Settings -> General remote-sync card that mounts an institutional CIFS/SMB share and copies experiment images to it as they are captured. Replaces the legacy hardcoded-credential approach.

Behaviour

• On/off toggle; server path pre-filled with //ds.asuch.cas.cz/ueb/lhr but editable.
• Username + masked password. When a password is set the UI never reveals its length.
• Check connection stays disabled until both fields are filled; reports the real mount error on failure.
• Sync entire folder now for a one-shot backfill of the user's existing experiments.
• Remote layout: mounted share -> subfolder named after the researcher -> experiment folders (mirrors the legacy behaviour).
• Sync stops when toggled off, or when the researcher name changes.

Credentials are session-only, by design

The password is held in memory and never written to disk. It is lost on restart, deliberately. The UI says so in two places: always-visible helper text under the password field, and a confirmation toast on save --

For better security, credentials are not stored on disk and must be entered again after every system restart.

When sync is on but the password is gone after a restart, the card turns orange and reads "Inactive - credentials needed after restart" rather than appearing on while silently doing nothing.

Security design

This box has no auth and binds 0.0.0.0, and the mount runs under sudo, so both directions matter:

• Password cannot leak through the API structurally - there is no password field on any response model. The request model is separate and write-only; responses expose only a passwordSet boolean. Tested against every GET endpoint including /openapi.json.
• Never in ps aux - passed via a 0600 credentials file in a tmpfs runtime dir, unlinked in a finally covering success, non-zero exit, timeout and unexpected exceptions.
• No shell=True anywhere; fixed argv only. The server string is validated against a strict allowlist (plus length cap and .. rejection) since it flows into a sudo command - 27 hostile inputs are tested as rejected.
• Hardening options are literal and last in the sudoers pattern. Mount options are last-one-wins, so nosuid,nodev,noexec and the unprivileged uid/gid apply even if something unexpected slipped through validation. This is what keeps the grant from being an escalation path.
• sudoers is validated with visudo -c before installation and is not installed if validation fails (a malformed file in /etc/sudoers.d can lock the account out of sudo entirely). Scoped to exactly two commands, never a blanket ALL. Removed by uninstall.sh.

Robustness

• Copies run off the capture path on worker threads with timeouts - a hung or dead share can never stall the experiment schedule.
• A sync failure never aborts a run: it is logged, marked pending, and retried on the next capture. The local experiment is the source of truth; the remote copy is best-effort.
• Degrades gracefully in simulation mode with no CIFS server present.

Notes on two judgment calls

1. Remote-sync config lives in its own remote_sync.json, not DeviceSettings - a share path is not a property of how an image was taken, and it keeps credentials out of per-experiment config snapshots.
2. mounted is a cached flag, not a live stat(). Statting a hung CIFS mount blocks uninterruptibly and the panel polls every 5s, so a live stat would let a dead share freeze the single-process API.

156 backend tests pass (77 new); npm run typecheck and npm run build clean.