Add Phase 2 dashboard + fix Phase 1 issues

- Implement parse_smb(), remove shell=True, add input validation, HTTP Basic Auth (Phase 1)
- Add /api/dashboard with daemon status, disk usage, per-share du, quota usage (Phase 2)
- Rewrite index.html with Dashboard as landing tab, progress bars, XSS-safe rendering
- Update README with full LXC install guide including git clone and update steps

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -2,45 +2,89 @@
 
 Lightweight web GUI to manage SMB shares, NFS exports, and quotas on a single home server (Proxmox LXC/VM). Runs directly on the host as a systemd service.
 
-## Requirements
+## Proxmox LXC setup
 
-```
-apt install samba nfs-kernel-server quota python3 python3-venv
+Use a **privileged** Debian/Ubuntu container — required for the NFS server kernel module and quotas.
+
+On the **Proxmox host**, load the NFS kernel module before starting the container:
+
+```bash
+modprobe nfsd
+echo nfsd >> /etc/modules
 ```
 
 ## Install
 
-```bash
-# Copy files
-cp -r . /opt/micronas
+Run everything below **inside the LXC container** as root.
 
-# Create virtualenv and install deps
+### 1. System dependencies
+
+```bash
+apt update
+apt install -y git samba nfs-kernel-server quota python3 python3-venv
+```
+
+### 2. Clone the repo
+
+```bash
+git clone https://github.com/yourusername/micronas.git /opt/micronas
+# or if you're self-hosting:
+# git clone git@yourserver:micronas.git /opt/micronas
+```
+
+### 3. Python environment
+
+```bash
 python3 -m venv /opt/micronas/venv
 /opt/micronas/venv/bin/pip install flask gunicorn
+```
 
-# Create environment file with your credentials
+### 4. Credentials
+
+```bash
 cat > /etc/micronas.env <<EOF
 MICRONAS_USER=admin
 MICRONAS_PASS=changeme
 EOF
 chmod 600 /etc/micronas.env
+```
 
-# Install and enable the systemd service
+### 5. systemd service
+
+```bash
 cp /opt/micronas/micronas.service /etc/systemd/system/
 systemctl daemon-reload
 systemctl enable --now micronas
 ```
 
-The app listens on `127.0.0.1:5000`. Put a reverse proxy (nginx) in front if you want HTTPS, or reach it directly on the LAN by binding to `0.0.0.0:5000` (change `-b` in the unit file).
+Open `http://<lxc-ip>:5000` in your browser.
+
+## Updates
+
+```bash
+cd /opt/micronas
+git pull
+systemctl restart micronas
+```
+
+## Network
+
+The service binds to `127.0.0.1:5000` by default. To reach it directly from the LAN, change `-b 127.0.0.1:5000` to `-b 0.0.0.0:5000` in `micronas.service`, then run `systemctl daemon-reload && systemctl restart micronas`.
+
+For HTTPS, put nginx in front as a reverse proxy.
+
+LAN or Tailscale only — never expose to the internet.
 
 ## Dev / test
 
 ```bash
-MICRONAS_USER=admin MICRONAS_PASS=secret flask --app app run --debug
-# or with docker-compose for a sandbox:
+# Quick local run (no gunicorn needed):
+MICRONAS_USER=admin MICRONAS_PASS=secret flask --app app.py run --debug --host=0.0.0.0
+
+# Or with docker-compose (UI only — systemctl/samba calls won't work):
 docker compose up
 ```
 
 ## Auth
 
-Set `MICRONAS_USER` and `MICRONAS_PASS` in the environment (or `EnvironmentFile`). All routes require HTTP Basic Auth. Never expose this to the internet — LAN or Tailscale only.
+All routes require HTTP Basic Auth. Credentials come from `MICRONAS_USER` / `MICRONAS_PASS` environment variables (set via `/etc/micronas.env` in production). If `MICRONAS_PASS` is not set the app starts unprotected and logs a warning — don't do this in production.