nwconn: persist AFP invisible file attributes

Extend the conservative NCP 0x2222/35/16 AFP 2.0 Set File Information smoke path beyond FinderInfo-only writes by accepting the file Attributes bitmap for one deliberately narrow bit: Finder Invisible.

WebSDK and Netatalk FPSetFileParams semantics carry file attributes as bitmap bit 0, with ATTRBIT_SETCLR selecting set-vs-clear behavior. Mirror that model only for ATTRBIT_INVISIBLE and reject all other AFP attribute bits so DOS/NetWare mode bits, timestamp writes, resource forks, and broader file protection semantics are not implied accidentally.

Persist the mars_nwe-owned AFP attribute word in org.mars-nwe.afp.attributes via the local xattr abstraction. On Linux this maps to user.org.mars-nwe.afp.attributes, matching the org.mars-nwe.* source-level namespace while remaining portable on Linux xattr backends. Get File Information and Scan File Information now merge that stored Invisible bit into the existing 120-byte AFP file-info record.

Update the Linux Set File Information smoke helper with --invisible, --clear-invisible, --attributes-only, and --finder-info-only so FinderInfo and the narrow AFP attribute path can be tested independently or together.

Tests: git diff --check

Tests: gcc -Iinclude -I/mnt/data/stubs -fsyntax-only tests/linux/afp_set_file_info_smoke.c

TODO: keep all other AFP Set File Information bits rejected until their write-safe mapping to NetWare/DOS attributes, timestamps, CNID, and resource-fork metadata is designed.

tests/linux/README.md

@@ -383,7 +383,7 @@ If the server was built without the optional Netatalk/libatalk backend, use
 when a scan continuation is expected to reach the end of the directory.
 
 
-## AFP Set File Information FinderInfo smoke test
+## AFP Set File Information metadata smoke test
 
 `afp_set_file_info_smoke` sends the WebSDK-documented NetWare AFP 2.0 request:
 
@@ -391,11 +391,13 @@ when a scan continuation is expected to reach the end of the directory.
 NCP 0x2222/35/16  AFP 2.0 Set File Information
 ```
 
-The helper exercises only the first write-safe AFP subset: the file FinderInfo
-bitmap (`0x0020`).  It sends a path-backed raw `VOL:`-style request, writes the
-32-byte FinderInfo block to mars_nwe's private `org.mars-nwe.afp.finder-info`
-metadata key, and immediately verifies the update through AFP 2.0 Get File
-Information.  On Linux the source-level `org.mars-nwe.afp.*` name is stored via the
+The helper exercises two deliberately narrow write-safe AFP metadata subsets:
+the file FinderInfo bitmap (`0x0020`) and the file Attributes bitmap (`0x0001`)
+restricted to the Finder Invisible bit.  It sends path-backed raw `VOL:`-style
+requests, writes the 32-byte FinderInfo block to mars_nwe's private
+`org.mars-nwe.afp.finder-info` metadata key, writes the narrow AFP attribute word
+to `org.mars-nwe.afp.attributes`, and immediately verifies the updates through
+AFP 2.0 Get File Information.  On Linux the source-level `org.mars-nwe.afp.*` name is stored via the
 portable `user.` xattr namespace by mars_nwe's local xattr wrapper, the same
 pattern Netatalk uses for its `org.netatalk.*` metadata names.
 
@@ -445,10 +447,29 @@ For the verified FinderInfo smoke run, the FinderInfo xattr starts with
 user.org.mars-nwe.afp.finder-info=0x544558544d415253000000000000000000000000000000000000000000000000
 ```
 
-All other Set File Information bitmap bits are intentionally rejected for now.
-That keeps attribute, timestamp, DOS/NetWare mode-bit mapping, resource-fork,
-and Entry-ID-only write semantics out of this first metadata-only write smoke
-path.
+Finder Invisible can be tested without mutating DOS/NetWare mode bits:
+
+```sh
+./tests/linux/afp_set_file_info_smoke \
+  -S MARS -U SUPERVISOR -P secret \
+  --attributes-only --invisible \
+  SYS:PUBLIC/pmdflts.ini
+
+getfattr -n user.org.mars-nwe.afp.attributes -e hex /var/mars_nwe/SYS/public/pmdflts.ini
+```
+
+The xattr payload is versioned.  For an invisible file the expected Linux form
+is:
+
+```text
+user.org.mars-nwe.afp.attributes=0x01000001
+```
+
+Use `--clear-invisible --attributes-only` to clear that bit; the same xattr then
+stores `0x01000000`.  All other Set File Information bitmap bits and all other
+AFP attribute bits are intentionally rejected for now.  That keeps timestamp,
+DOS/NetWare mode-bit mapping, resource-fork, and Entry-ID-only write semantics
+out of this metadata-only smoke path.
 
 If the server was built without the optional Netatalk/libatalk backend, use
 `--allow-invalid-namespace` for the expected negative test.  Use