Mount NFS destinations with nolock so they need no nfs-common (0.66.2)

An NFSv3 mount with locking makes the kernel register its lock manager
with rpcbind on the Docker host itself. On a host without nfs-common the
mount fails with a bare "connection refused" that reads like the NAS is
unreachable, even though the NAS and its ports are fine.

Only StackPilot ever writes the backup files on an NFS destination, one
writer per file, so nothing needs locking. mount_options() now adds
nolock unless the options already choose (lock, nolock, local_lock=) or
ask for NFSv4, which locks in-protocol and needs no rpcbind. Existing
destinations get their volume recreated once with the new options.

The refused-mount hint now points at rpcbind/nfs-common on the Docker
host first, and "protocol not supported" explains the missing kernel
module (modprobe nfsv4). The form labels the option.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "stackpilot-frontend",
   "private": true,
-  "version": "0.66.1",
+  "version": "0.66.2",
   "type": "module",
   "scripts": {
     "dev": "vite",

frontend/src/pages/Settings.tsx

@@ -526,7 +526,7 @@ const FIELDS: Record<string, { key: string; label: string; secret?: boolean; are
   nfs: [
     { key: "server", label: "NFS server (host or IP)", placeholder: "10.0.0.5" },
     { key: "path", label: "Export path", placeholder: "/export/backups" },
-    { key: "options", label: "Mount options", placeholder: "rw,nfsvers=4 (default: rw)" },
+    { key: "options", label: "Mount options (nolock is added unless you set lock)", placeholder: "default: rw" },
     { key: "subdir", label: "Subdirectory inside the export (optional)", placeholder: "stackpilot" },
   ],
 };